Requires scope: engagement:context:update

Deep-merges metadata into the Engagement's existing metadata blob: where a key is a dict on both sides it's merged recursively rather than replaced outright, any other value (scalar or list) is replaced, and keys not included here are left untouched at every level, so a concurrent writer's keys (e.g. disposition_service) survive.

master_record_id, when provided either as its own field or as a key inside metadata, also sets the Engagement's master_record_id column (read by get_basic_context_payload for the member lookup) -- mirroring disposition_service.write_disposition's precedent of writing the id to the column AND leaving it in the blob. Overwriting an already-set id is logged to EngagementActivityLog; the first null -> id assignment is not, since that's the normal outcome of IVR/ANI identification rather than a notable identity correction.

The disposition key is reserved for CMS call-logging compliance data (see docs/CMS_CALL_LOGGING_COMPLIANCE.md) and is rejected here with 400 — use the dedicated disposition service to write it.