fix(datastore): repair transaction locking and auto-rollback - #546

Fixes #543

What changed

• Auto-rollback context: the rollback keeps the values of the request context (logger) but not its cancellation, so it no longer runs on a dead context.
• Timer: TransactionCancelTimer is replaced by time.AfterFunc. Confirm, Cancel and the timer are arbitrated under the TransactionManager lock, which removes the close of closed channel panic and the data race. The auto-rollback checks under the lock that its transaction is still the registered one.
• Id checks first: Confirm, Cancel and the auto-rollback validate the transaction id before any side effect. A wrong id no longer disarms or rolls back the active transaction, and a late timer can't unregister a newer one.
• Locking: the auto-rollback blocks on dmutex (order dmutex -> tmMutex) via the new WithAutoRollbackLock option, so it can't race Sync Revert and TransactionSet stays fail-fast. The guard cleanup now takes tmMutex.
• Failed rollbacks: a failed Cancel or auto-rollback keeps the transaction registered with Cancel available for retry, instead of dropping it.
• No-op transactions: the timer is armed for them too (timeout only unregisters, no device call), so an unconfirmed no-op no longer blocks the datastore forever.
• Dry-run: the transaction guard is not used (fixes the nil dereference), and a replace intent is only validated, not applied or written back.
• Confirm: no longer takes dmutex since it never touches the device, and rejects a transaction that is not committed yet. Cancel keeps dmutex because it rolls back on the device.
• API: outerloop removed, ErrTransactionOngoing maps to codes.Aborted, and a non-positive timeout is rejected with InvalidArgument.

Differences from the suggestions in the issue

• update deps #5 only affected dry-run; in a normal run the replace already holds dmutex and a registered transaction.
• do not throw warning when using remote schema server #8: only Confirm drops dmutex; Cancel needs it.

Not addressed

• A replace can't be rolled back (oldRunning is recorded after the replace is applied).
• Errors after the device was changed (IntentModify, writeBackSyncTree) still only unregister the transaction.
• A dry-run with a replace reports updates/deletes computed without the replace.
• The auto-rollback has no deadline of its own while holding dmutex and tmMutex.

Behaviour changes for clients

• A busy datastore returns Aborted instead of Unknown.
• timeout <= 0 is rejected.

Testing

go test -race ./pkg/datastore/... ./pkg/server/... passes. New regression tests cover each scenario from the issue (pkg/datastore/types/transaction_manager_test.go, pkg/datastore/transaction_lock_test.go).