Fix idle maintenance CPU and release v0.3.3

[yannick]

Persistent stores previously opened expiry iterators every 100 ms on every shard, rebuilding range masks and repeatedly purging empty cold partitions. Park proven TTL-free partitions, bound discovery to owned partitions, cache immutable ondaDB range fragments, and skip empty cleanup. Fresh feature-negotiated nonce proofs bind cold deletion to the current data generation and placement epoch; old peers continue ordinary replication but cannot authorize cleanup until upgraded.

Fix INFO key/expiry visibility, expose maintenance and range-memory metrics, pin reviewed ondaDB commit 0f4ebc67434551c9d3d4cba899829234760f4215 (ondadb PRs #2/#3), add deterministic CI regressions, and require the quality gate before image publication. Prepare patch version 0.3.3 and update website/design documentation.

Validation: local just ci passed (605 tests, zero failures, three existing ignored); ondaDB default/unsafe-fastpath suites and both Clippy gates passed. The 60-second synthetic 18,117-range process fixture reduced idle CPU from 29.2/70.4/337.5% to 0.38/0.34/0.37% for 1/2/10 shards, with zero idle expiry iterator growth. Independent source reviews passed. Final Docker 1/2/10-shard runs all passed: zero idle expiry/range work, stable ownership, key/member TTLs, persistent/seed data retention and autonomous restart repair while peers were disconnected. Repeated fixed aggregate CPU was 6.5–7.2%, compared with baseline 101–561%; throughput and per-command p99 improved across all configurations. The results report documents host-load limits and a corrected Docker published-port harness issue. No live Annotix rollout.