fix(seed): deferred reference update failures are swallowed as success

[yinlianghui]

Baseline and relation to #2678/#2680

• Verified at 98874656ffc50ce1531af52346228ffcdda73fba.
• The affected deferred-update catch predates perf(seed,import): route bulk writes through the engine's batch insert path #2680 (blame: 11f9767336, original seed loader work) and was unchanged by perf(seed,import): route bulk writes through the engine's batch insert path #2680.
• It is not a perf(seed,import): route bulk writes through the engine's batch insert path #2680 regression, but it violates seed-loader success/error accounting and hides a transient seed write failure relevant to perf/reliability: seed + data-import bypass the engine's bulk-insert path → N round-trips, N summary recomputes, no transient retry #2678.

Minimal reproduction

Load circular real-SQL seed data (department ↔ worker) with multi-pass resolution enabled. Inject one fetch failed in the pass-2 deferred reference update.

Repeated twice on fresh databases.

Expected / actual

• Expected: retry a transient update; if it still fails, report an error and return an unsuccessful load with the deferred reference unresolved.
• Actual: the update is attempted once, the catch only logs a warning, allErrors remains empty, and the loader returns success:true while the source lookup remains null.

Impact

Seed-once/boot logic can accept incomplete relational data as a successful seed, with no actionable error in the returned result.

Evidence and exclusions

• Source: packages/metadata-protocol/src/seed-loader.ts, resolveDeferredUpdates catch.
• The no-fault circular case resolves both references and passed.
• This is separate from self-referencing sequential retry: it is pass-2 error propagation/accounting for cross-object deferred references.

Required regression tests

• Transient deferred update retries.
• Exhausted update failure is appended to returned errors, leaves deferred accounting accurate, and makes success false.
• No-fault circular resolution remains successful.

[yinlianghui]

独立重现审计补充（2026-07-11）

Issue 原文缺少可由第三方直接构造的对象/seed fixture 与故障注入停止条件；本轮按以下最小规格补齐，并在固定 baseline 98874656ffc50ce1531af52346228ffcdda73fba 的全新 better-sqlite3 文件库运行 1 次：

• 对象 audit_department(name, head_id -> audit_worker) 与 audit_worker(name, department_id -> audit_department)。
• seed：department {name: "Engineering", head_id: "Alice"}；worker {name: "Alice", department_id: "Engineering"}；multiPass:true、mode:"insert"。
• 在 pass-1 两条记录均写入后，对 engine.update("audit_department", {id, head_id}) 的第一次调用精确注入 Error("fetch failed")；之后恢复原 update。停止条件是 loader 返回且读取两张表。

实际（本轮 1/1，进程 exit 0）：updateAttempts=1，仅记录 warning Failed to resolve deferred reference ... fetch failed；返回 success:true、errors:[]、totalErrored:0、totalReferencesDeferred:1；audit_department.head_id=null，而 worker 的反向引用已解析。与 Issue 结论一致。

这是本轮临时 harness 的完整输入规格；harness、SQLite 和日志按审计要求只在 /tmp 使用并删除，不作为产品测试代码提交。