fix(storage): make ListStaged report only keys DeleteStaged accepts - #906

Motivation:
ListStaged (internal/storage/local.go) walks for "*.part" staging
files, strips PartSuffix, and reports the result as the key the
partial belongs to. DeleteStaged resolves that same key through
stagedPath, which validates the key body with validateKeyBody. A
partial left behind by an older Arc version can belong to a key that
is illegal under today's contract -- for example one containing a
backslash, which validateKeyBody refuses because Azure treats it as a
path separator -- so ListStaged reported it and DeleteStaged then
refused it. reclaimStagedPartials (internal/api/databases.go), which
DROP DATABASE uses to clean up abandoned partials, pipes ListStaged's
output directly into DeleteStaged, so it logged a warning for that
file on every run and never reclaimed it.

Approach:
ListStaged now runs the stripped key through stagedPath -- the exact
validation DeleteStaged applies -- before reporting it, and skips any
entry that call refuses. A partial with an illegal key is not lost
from view: ListUnusable already reports exactly what the ordinary
listings (List/ListObjects) drop, and a ".part" file whose stripped
key fails ValidateKey falls through its "committed object named
*.part" carve-out to being reported there. The legacy
"once-legal-key-is-now-reserved" reclaim path (a partial for a key
that merely collides with the reserved ".part" suffix, not one that
fails validateKeyBody) is unaffected, since stagedPath deliberately
validates without that reserved-suffix rule.

Out of scope, per the issue: a committed object whose real name ends
in ".part" (legal before the suffix was reserved) is indistinguishable
by name from a staging partial and is not addressed here.

Validation:
- go build ./... succeeds.
- gofmt -l on both changed Go files is clean.
- go vet -tags=duckdb_arrow ./internal/storage/... is clean.
- go test ./internal/storage/... and
  go test -tags=duckdb_arrow -race ./internal/storage/... both pass,
  including the new test.
- Added TestListStagedOmitsWhatDeleteStagedWouldRefuse to
  internal/storage/staging_test.go: writes a file
  "db/weird\name.part" directly to disk, simulating a legacy orphan,
  and asserts ListStaged("db/") returns no entries while
  ListUnusable("db/") reports exactly that one file. Confirmed this
  test FAILS against the pre-fix ListStaged (reverted local.go alone,
  kept the test) and PASSES after the fix, which is the regression
  proof.
- Did not run the whole-repo race suite or the MinIO-backed
  objectstore-tagged tests: the change is confined to
  LocalBackend.ListStaged, which S3Backend and AzureBackend do not
  implement.

Report: Basekick-Labs#772

Assisted-by: claude-sonnet-5 (via Claude Code)
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>