refac: atomic merge, lost-update race, RunPurge cost, duplicated walks

features/media_library.feature

@@ -363,11 +363,11 @@ Feature: The media library holds every uploaded image as a library-level asset
       And article 1's body is back to its original text, article 2 is unchanged
       And images 2 and 3 still exist
 
-    Scenario: A failure deleting a copy after the rewrite is 500 and the bodies stay switched
+    Scenario: A failure deleting a copy after the rewrite is 500 and the bodies are rolled back
       Given the image repository's Delete fails for image 3
       When the client sends POST /v1/media/merge with {"keep_id": 2, "merge_ids": [3]}
       Then the response status is 500
-      And article 1's and article 2's bodies use image 2's url and image 3 still exists
+      And article 1's and article 2's bodies are back to their original text and image 3 still exists
 
   @manual
   Rule: Startup backfill and migration (persistence, verified by hand, see the qa.md)