fix(8.0): metadata cold-read guard — no more silent [] on cold find({where})

A downstream deployment reported find({where}) returning a silent [] on a
freshly-opened brain (a native metadata provider that reports data but hasn't
loaded its field postings), blanking filtered pages after every restart. Brainy
had a cold-read guard for GRAPH reads (verifyGraphAdjacencyLive → self-heal or a
loud GraphIndexNotReadyError) but no equivalent for metadata `where`.

Add verifyMetadataLive() — the field-index counterpart, one-shot per brain on the
first filtered find(): probe a known persisted entity's plain field value; if the
index serves it, live (the only cost on a warm brain — one O(1) probe). If not,
the postings didn't load: rebuild from canonical + re-probe; if still unserved,
throw the new exported MetadataIndexNotReadyError rather than let a silent [] pass.
Inconclusive cases (empty store, no plain field, shared-store foreign entity,
migrating provider) resolve to live — never a false rebuild.

The 8.0 open-core JS index already cold-loads correctly (verified: cold where 3/3,
cold related 2/2) — this guards the NATIVE path, where the durable cold-load cure
is cortex-side (same shape as the graph 2.7.8 cure). 4 unit tests (warm no-rebuild,
self-heal, loud-fail, no-filter-no-probe). Gates: typecheck 0, build 0, test:unit
1757/1757.

src/errors/brainyError.ts

@@ -12,6 +12,7 @@ export type BrainyErrorType =
   | 'VALIDATION'
   | 'FIELD_NOT_INDEXED'
   | 'GRAPH_INDEX_NOT_READY'
+  | 'METADATA_INDEX_NOT_READY'
   | 'MIGRATION_IN_PROGRESS'
 
 /**
@@ -255,6 +256,29 @@ export class GraphIndexNotReadyError extends BrainyError {
     }
 }
 
+/**
+ * Thrown when the metadata field index reports data but cannot serve a KNOWN
+ * persisted field value even after a rebuild — i.e. the `where` / filter
+ * postings did not load on a cold open and could not be restored. The
+ * field-index counterpart of {@link GraphIndexNotReadyError}: it replaces the
+ * silent-empty failure mode (a cold `find({ where })` returning `[]`
+ * indistinguishable from "no such data") with a loud, catchable error, so a
+ * consumer never renders "nothing found" over data that is simply not-yet-warm.
+ *
+ * Detected once per brain by a known-value serving probe on the first filtered
+ * `find()`; brainy self-heals (rebuilds the index from the canonical records)
+ * first and only raises this if the rebuild still cannot serve the known value.
+ */
+export class MetadataIndexNotReadyError extends BrainyError {
+    constructor(message: string, originalError?: Error) {
+        super(message, 'METADATA_INDEX_NOT_READY', false, originalError)
+        this.name = 'MetadataIndexNotReadyError'
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, MetadataIndexNotReadyError)
+        }
+    }
+}
+
 /**
  * Thrown when a data-plane read or write is issued against a brain that is
  * running its one-time, automatic 7.x → 8.0 on-disk upgrade — the coordinated