Add pluggable feature storage and port soft-delete to the runtime index

[npiesco]

Closes the two gaps left after the cluster-pruning fix (#1), both on both indexes.

Pluggable feature storage

Upstream rust-cv/hnsw#39 proposed keeping features outside the heap. The idea is right; that implementation is not adoptable here:

• DiskFeatureStore::get returns a reference into a single thread_local! UnsafeCell scratch buffer. Two live references from one store alias the same address - UB, and it silently turns distance(a, b) into distance(x, x).
• MmapFeatureStore::get has no bounds check, so index == capacity dereferences one past the end of the mapping.
• Its tests build 8 points at M=12/M0=24, which never saturates a neighbor list and so never reaches the pruning branch - the one place the aliasing bug is fatal.
• Its add_neighbor hunk is written against nearest-M truncation; accepting it would revert d7b9d27 and restore the cluster-isolation bug.
• Its copy_from_slice fix is already here, in both indexes, via 8d37b6b.

So the trait is written here rather than taken.

FeatureStore<T> is borrow-based: get_feature returns &T, push_feature appends, feature_count reports the size. Hnsw and HnswRuntime gain a trailing storage parameter defaulting to Vec<T>, so every existing signature is unchanged.

The borrow-stability contract is load-bearing. The diversity heuristic from #1 holds three feature references live at once while pruning a saturated list - the target, the candidate, and each already-kept neighbor. A store decoding into a shared buffer would alias all three onto one address, every comparison would collapse toward distance(x, x), the heuristic would degenerate back into nearest-M truncation, and dense clusters would close themselves off again. That is exactly the failure #1 fixed, so the contract is documented on the trait and tested.

Methods are named get_feature/push_feature/feature_count, not get/push/len: a trait method named get on Vec<T> shadows slice::get wherever the trait is in scope, because trait methods on the receiver type beat inherent methods reached through Deref.

tests/feature_store.rs drives a real mmap-backed store over a real file against a 160-point four-cluster corpus that does saturate M0=24 lists:

Test	What it pins
mmap_store_matches_vec_store_on_saturated_clustered_data	identical ranked results, const index
runtime_mmap_store_matches_vec_store_on_saturated_clustered_data	identical ranked results, runtime index
mmap_store_preserves_cross_cluster_reachability	a dense 37-point far cluster still cannot hide the three points beside the origin
concurrently_live_feature_handles_stay_valid	three live handles keep distinct stable addresses; a real distance between two stays non-zero

The last one fails against a scratch-buffer store - it is the direct test of the contract.

Soft-delete on the runtime index

HnswRuntime had no delete surface, so the two indexes were not actually mirrors. Ported live_count, is_deleted, mark_delete, entry, plus both search-path changes: the zero-layer tombstone branch that traverses a deleted node without admitting it to the result heap, and the retain that drops tombstones from the final set.

tests/incremental_delete.rs now covers both, including runtime_and_const_agree_under_identical_deletions, which applies the same deletion set to the same corpus in both indexes and asserts the ranked lists match.

Verification

21/21 tests pass with --all-features:

Suite	Tests
clustered_recall	5
feature_store (new)	4
incremental_delete	3
random	2
runtime_parity	1
serde	1
simple	3
simple_discrete	2

runtime_parity and serde matter most: the first shows the two indexes did not drift, the second shows the added serde bounds and the #[serde(skip)] PhantomData leave the snapshot format unchanged.

cargo clippy --all-targets -- -D warnings is clean with default features and with --all-features; cargo fmt --check is clean. That required fixing lints predating this change in hnsw_const.rs, the examples and the benches. No warning was suppressed.