[beinan]

Summary

A rollout registry entry can point to a dataset outside the path derived from its logical name. A cold worker currently opens that derived path, the metadata endpoint reports it, and uncached deletion targets it. Use the registered URI for open/delete and the opened store's URI in metadata responses. Recheck the directory entry before caching a new handle, and refuse deletion when an existing handle points to a different URI.

This is a prerequisite for separately assigned physical table locations. It does not add generation allocation, distributed cache invalidation, or a catalog compare-and-delete protocol.

Refs #378.

Testing

• Real local Lance datasets verify registered-location selection, metadata, uncached deletion and preservation of a dataset at the derived path.
• Controlled registry changes during a real dataset open verify removal/replacement cannot install that stale handle.
• A live-handle mismatch rejects deletion without removing either dataset or its catalog entry.
• Full repository check script passed: workspace formatting, Clippy and all-target Rust tests (591 passed); Python tests (229 passed, 2 skipped, 1 xfailed), Ruff formatting/lint and Pyright.