Add atomic multi-entity and grant-record commit SPI

CHANGELOG.md

@@ -76,6 +76,11 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
 ### Deprecations
 
 ### Fixes
+- Fixed JDBC persistence to make grant/revoke, createCatalog, and dropEntity operations atomic
+  by batching consecutive writes in a single transaction. A new `BasePersistence.flush()` method
+  commits any pending batched writes; `AtomicOperationMetaStoreManager` calls it after sequences
+  of writes that should be atomic. This removes the partial-commit window for JDBC without adding
+  RBAC-specific methods to the persistence SPI.
 - Fixed a boundary condition in GCS downscoped credential generation (`GcpCredentialsStorageIntegration`). Locations without a trailing slash could previously grant access to sibling object prefixes via the generated CEL conditions for `resource.name` and list prefixes. Granted paths are now normalized to a directory prefix (with a trailing slash) before the CEL conditions are built, so sibling prefixes can no longer satisfy the `startsWith` checks.
 - Async task execution (table cleanup, manifest and batch file cleanup) now retries when a handler returns false on transient errors (e.g. IO or delete failures). Previously `false` was swallowed with only a warning log and the task was never retried via the existing retry mechanism.
 - Fixed `NullPointerException` during `dropEntity` when an entity referenced by a grant had been concurrently removed (or purged). `lookupEntities` can return null entries for dropped entities; these are now skipped safely.