Share the metadata write, fixing provenance on the bulk path

Share the metadata write, fixing provenance on the bulk path The single-asset PATCH and the bulk executor each had their own copy of the metadata write, and they had already drifted. The bulk one is documented as merging "exactly as the single-asset PATCH endpoint does" and did not: it omitted enrichment::forget_provenance, so a bulk edit left a model's marking on a field a person had just overwritten. Nothing failed — the value was correct and the marking was false, which is the direction that makes people stop trusting the marking at all. The comment claiming parity is what kept it invisible, so the fix is one copy rather than a third call added to the second copy. dam_db::metadata::merge owns the merge semantics and all three writes; both callers use it. The outbox row stays at the call sites, because each route names itself in the event it emits. Pinned by a test that fails without the forget_provenance call. Prerequisite for the transfer slice, which would have been the third copy.