Add public delete/restore/purge lifecycle for catalog records

[brendan-m-murphy]

Goal

Add a public record deletion lifecycle for ogcat without exposing raw repository hard-delete behavior as the default user workflow.

Current state

• CatalogRepository.delete(record_id) and TinyDbCatalogRepository.delete(...) already hard-delete records.
• UnitOfWork.insert_staged_record() uses repository deletion for rollback cleanup.
• Catalog has no public delete/trash/tombstone method.
• Long-term docs anticipate record status values including deleted and leave open whether delete should mean tombstone by default.

Proposed direction

Make user-facing deletion a tombstone/soft-delete operation by default. Physical purge should be explicit and separate.

Suggested API shape:

record = catalog.delete(record_id, reason=None)
record = catalog.restore(record_id, reason=None)
catalog.purge(record_id, force=False)

Search/list should hide tombstoned records by default and expose include_deleted=True and only_deleted=True.

Constraints

• Do not silently remove artifact data.
• Do not remove external references or user-owned paths by default.
• Keep repository.delete() available for rollback/internal hard-delete behavior.
• Use existing operation/update/rollback/audit patterns rather than adding deletion logic directly to Catalog.

Acceptance criteria

• A record can be tombstoned through the public Python API.
• Tombstoned records are hidden from default search/list results.
• Tombstoned records remain retrievable for inspection and can be restored.
• Existing records migrate/read as active by default.
• Hard delete remains available internally or through an explicit purge API.
• Purge does not remove artifact data unless explicitly requested and safe.
• CLI behavior is documented and covered by tests.