kafka: verify 3.9 topic identity before reusing logs

[bringhurst]

Fix the assigned-before-return variant described in #584. Assignment does not identify a recreated topic generation because bridge control messages omit topic IDs.

Under the existing default-off cleanup flag, read the authoritative ZooKeeper topic IDs on the control path, persist IDs before accepting records, and retire only known obsolete generations. Keep unidentified nonempty logs and conflicting current/future copies for recovery. Validate supplied wire IDs, fence failed controller updates, and retry failed full-image checks. Reject cleanup on an IBP without topic IDs. Flag-off behavior is unchanged.

Both full ReplicaManagerTest suites and dedicated identity/cache tests pass. The assigned-before-return target failed before the repair and passed with the initial repair; the tightened current safety paths have fresh unit coverage. All 68 Python tests pass. Scenario revision 4 now requires both broker generations and both assignment timings; its complete process run is active. Old scenario evidence is rejected.

This is a draft, not rollout approval. The private wrapper dependency refresh requires the internal network/VPN, so current final wrapper qualification is blocked. Production client/state/runtime/capacity and named security/release approvals remain separate gates.

[bringhurst]

The deleted-topic batch correction is published with the paired 3.0 change in #585. Both full ReplicaManagerTest suites, dedicated identity tests, the real-ZooKeeper identity test, and Scala 2.13 compilation pass. The current local scenario-4 run has completed all four generation/assignment-timing promotion checks with exact replacement records; the complete run is still active, so this is not a full-migration pass. I also restacked this PR onto the hourly-log retention fix in #584. That only changes the evidence collector and its tests; broker source is unchanged by the restack. The Python suite now has 70 passing tests. Final wrapper qualification still requires the internal-network dependency refresh.

[bringhurst]

The local scenario-4 run has now finished as a failure, not a pass. All four offline-name-reuse promotion/record checks passed, and the source fingerprint stayed unchanged. At the native checkpoint, the old metadata-churn helper exited on ControllerMovedException while controller movement was in progress. It had advanced to 221 cycles.

The failure is retained at /tmp/li-scenario-4-batch-fixed. I am checking the helper's retry classification and the broker logs before changing anything; I am not treating a retry or the four scoped checks as proof that the complete migration passed. PR #587 now records this limit. Final wrapper qualification is separately blocked on the required internal-network dependency refresh.