filer: serialise concurrent index read-modify-write in pending metadata deletion

Add remoteMetadataDeletionIndexMu to Filer and acquire it for the full
read→mutate→commit sequence in markRemoteMetadataDeletionPending and
clearRemoteMetadataDeletionPending, preventing concurrent goroutines
from overwriting each other's index updates.

Made-with: Cursor

weed/filer/filer.go

@@ -62,7 +62,8 @@ type Filer struct {
 	deletionQuit        chan struct{}
 	DeletionRetryQueue  *DeletionRetryQueue
 	EmptyFolderCleaner  *empty_folder_cleanup.EmptyFolderCleaner
-	remoteDeletionLoop  sync.Once
+	remoteDeletionLoop            sync.Once
+	remoteMetadataDeletionIndexMu sync.Mutex
 }
 
 func NewFiler(masters pb.ServerDiscovery, grpcDialOption grpc.DialOption, filerHost pb.ServerAddress, filerGroup string, collection string, replication string, dataCenter string, maxFilenameLength uint32, notifyFn func()) *Filer {

weed/filer/filer_delete_entry.go

@@ -253,6 +253,9 @@ func (f *Filer) reconcilePendingRemoteMetadataDeletions(ctx context.Context) err
 }
 
 func (f *Filer) markRemoteMetadataDeletionPending(ctx context.Context, path util.FullPath) error {
+	f.remoteMetadataDeletionIndexMu.Lock()
+	defer f.remoteMetadataDeletionIndexMu.Unlock()
+
 	txnCtx, beginErr := f.BeginTransaction(ctx)
 	if beginErr != nil {
 		return beginErr
@@ -289,6 +292,9 @@ func (f *Filer) markRemoteMetadataDeletionPending(ctx context.Context, path util
 }
 
 func (f *Filer) clearRemoteMetadataDeletionPending(ctx context.Context, path util.FullPath) error {
+	f.remoteMetadataDeletionIndexMu.Lock()
+	defer f.remoteMetadataDeletionIndexMu.Unlock()
+
 	txnCtx, beginErr := f.BeginTransaction(ctx)
 	if beginErr != nil {
 		return beginErr