Issue Summary

Investigate whether WiredTiger should verify the shared/stable disaggregated metadata file (WT_DISAGG_METADATA_URI = file:WiredTigerShared.wt_stable). Today no code path runs verify on it, so the shared metadata is never verified in disaggregated mode.

Context

• The open-time verify_metadata=true path (src/conn/conn_api.c:3773) only verifies WT_METAFILE_URI (the local metadata, file:WiredTiger.wt). This is correct but incomplete in disaggregated mode: the local metadata always exists, but the shared metadata is an additional file that nothing verifies.
• Because nothing ever verifies the disagg metadata, the assertion in __curhs_btree_id_to_hs_id (src/cursor/cur_hs.c:1384, "Shared metadata and history store should not have history store entries") never fires today.
• [WT-17127] hardened the skip_hs check in src/btree/bt_vrfy.c to use WT_IS_URI_METADATA, so verify already correctly skips the explicit history store call for the shared metadata once a caller exists. This ticket is the follow-up to add that caller.

Constraints

• The shared metadata cannot be verified at conn_api.c:3770 during open: disaggregated storage is not initialized until __wti_connection_workers (conn_api.c:3807) runs recovery, so the shared metadata btree is not loaded yet (see also FIXME-WT-14721 at conn_api.c:2063).
• Post-recovery, the connection holds the shared-metadata dhandle open, so a naive session.verify("file:WiredTigerShared.wt_stable") returns EBUSY. An exclusive-access window for the shared metadata must be designed.

Proposed Solution / Investigation

• Decide whether the shared disaggregated metadata should be verified (at open and/or on demand).
• If yes, identify or create a point in connection startup where the shared metadata can be verified with exclusive dhandle access (post-recovery, around or before the dhandle being permanently held open).
• Add the verify caller for WT_DISAGG_METADATA_URI.

Definition of Done

• A decision is documented on whether to verify the shared disagg metadata.
• If verification is added: a caller verifies WT_DISAGG_METADATA_URI with exclusive access, and a test confirms it succeeds (and would have tripped the cur_hs.c assertion without [WT-17127]'s fix).
• Ticket is related to [WT-17127] and sits under epic [WT-16720].