ops: writes a layer performs in another thread or later, and batch side effects before commit, escape the redirect #5

Follow-up from #3 / PR #4 (adversarial review item 3). The ops functions route their write through the wrapper chain via a ContextVar redirect pinned to the expected leaf key. Two limits are documented in cosmodol/ops.py but not enforced:

1. A layer that performs the write in another thread, or later (a write-behind buffer), escapes the redirect: the write happens as the leaf's ordinary upsert/delete (no ETag check, outside a batch transaction). The function raises RedirectError but cannot undo it. Refusing such writes outright (a per-leaf pending-redirect registry) would also refuse unrelated concurrent writers sharing the leaf, so it was not done.
2. batch_items collects writes through the layers before committing; a layer acting after the inner write returns (write-through cache, audit log) has acted even if the commit fails.

Options: a per-leaf registry keyed by (leaf, expected key) that refuses only writes of the same key from another context while an op is pending; or a two-phase protocol layers can opt into. Nothing in the fleet uses such layers today.