test(metadata): cover non_filterable_keys exclusion rules

[HarshRajSinghania]

Summary

Adds unit tests for split_metadata() denylist behavior requested in #245.

tests/test_metadata.py already covered the filterable_keys allowlist. These tests cover non_filterable_keys without changing production code.

Related issue

Closes #245

What changed

Four tests in tests/test_metadata.py:

1. Direct exclusion — a key listed in non_filterable_keys stays in the DynamoDB copy and is omitted from S3 Vectors filter metadata.
2. Precedence over allowlist — when a key is in both filterable_keys and non_filterable_keys, the denylist wins.
3. Namespace isolation tag — listing _dv_ns in non_filterable_keys does not strip the mandatory namespace tag that split_metadata() always writes onto the S3 payload.
4. Input immutability — the caller metadata dict is unchanged after the split; mutating it afterward does not affect the returned copies.

No production code, dependencies, or docs were changed.

Testing

From a clone of development with PYTHONPATH=src (no AWS credentials):

PYTHONPATH=src python -m pytest tests/test_metadata.py -q --tb=short

Result: 29 passed (25 existing + 4 new).

A full editable install (pip install -e .) was not completed in this environment because the PyPI mirror returned 502s for boto3. The new tests only import dynavec.config and dynavec.metadata, which have no AWS runtime dependency.

Checklist

• Change is focused on one issue
• Tests added for the requested scenarios
• Tests run offline without live AWS credentials