Is there a canonical way to guarantee deleted data stays deleted in the Community Edition? Especially for data with non-expiring ttls.
The one correct way is to set short TTLs (relative to cold-start time) on your objects and to regularly touch them into the future. This comes with a cost of extra write IOPS every time you touch, if the data of that namespace is stored on SSD. The TTL should be what you consider the length of time for that node to cold-start, which in turn depends on the amount of data, and read IOPS capacity of the SSDs. Let's say it takes 1 hour for a node to restart. If you set the TTL on the objects to 1 hour, a deleted object will either not get inserted into the primary index (its void-time is already in the past) or it will expire before the node is back up. This way deleted records cannot be resurrected.
Otherwise, durable deletes are an enterprise feature you may need. Just consider the likelihood of this being an issue in your use case - different applications have very different access and storage patterns.