[BUG] DB.NewIterator leaks internal CF/version semantics

[feichai0017]

🐛 Bug Description

DB.NewIterator is documented as default CF user-key iterator, but currently surfaces internal semantics:

• returns entries from non-default CFs (lock/write)
• returns multiple MVCC versions for same user key

Code path:

• iterator.go:69 (contract comment)
• iterator.go:193-227 (materialization without CF/version filtering)
• internal dependency in raftstore/kv/apply.go:122-146

🛠 Reproduction Steps

1. Write one key in CFDefault, one in CFLock, one in CFWrite.
2. Iterate with db.NewIterator(&utils.Options{IsAsc:true}).
3. Observe all CFs are returned.
4. Write two versions for same user key and iterate again.
5. Observe both versions are returned.

📋 Expected Behavior

Public iterator contract should be explicit and consistent:

• either expose only default CF latest visible key
• or be renamed/documented as internal iterator API

📸 Screenshots / Logs

Observed output in repro:

• cf=default key=k1
• cf=lock key=k2
• cf=write key=k3
• key=k ver=2 val=v2
• key=k ver=1 val=v1

💻 Environment

• OS: macOS 26.2 (arm64)
• Go Version: go1.24.4
• NoKV Version: current main (local HEAD on 2026-02-11)

🧐 Additional Context

Current implementation creates abstraction leakage: internal raft scan relies on this behavior.