fix(runtimed): ephemeral notebook review cleanups

[quillaid]

Summary

Follow-up from #1669 code review — three small cleanups:

1. Cap redirect map at 1000 entries — prevents unbounded growth under extreme agent churn (thousands of save-and-disconnect cycles within an hour). Evicts oldest entries when the cap is hit.

2. Add delete_metadata() to NotebookDoc — replaces set_metadata("ephemeral", "") with a clean key deletion. No more empty string keys left in the CRDT.

3. Document promoted room persistence — clarifies that persist_tx remains None after ephemeral→persistent promotion. The .ipynb autosave (via file watcher) is the source of truth for file-backed notebooks, not .automerge persistence.

Test plan

• 224 lib tests pass (cargo test -p runtimed --lib)
• Tokio mutex lint passes
• Ephemeral room tests pass
• Lint clean (cargo xtask lint)

[rgbkrk]

I have to wonder if there's a pattern to "delete in" with automerge

[quillaid]

Re: the delete_metadata pattern — Automerge doc.delete(obj, key) errors if the key does not exist (no "delete if present" variant). The get-then-delete is necessary to return Ok(false) instead of propagating an error for missing keys. The error variant for "key not found" is not well-documented in automerge 0.7, so I went with the explicit check rather than matching on error types.