feat: implement persist_recover with snapshot load and WAL replay (P0-4)

- Add load_snapshot(): reads P0 sentinel ("XCESNAP\0" + lsn), validates magic,
  extracts checkpoint_lsn
- Add replay_wal(): scans seg-*.wal files in LSN order, skips entries <= from_lsn,
  verifies CRC chain, stops on mismatch, applies entries via apply_wal_entry() stub
- Add persist_recover(): find latest .capnp snapshot, load it, replay post-checkpoint
  WAL, retention pass (no-op in P0)
- Fix trim_wal_segments(): compare against active segment start LSN (not checkpoint_lsn)
  to avoid deleting the currently-open segment and losing post-checkpoint WAL entries
- Add restore_job() stub in job.c (P0-12a placeholder)
- Add worker_from_capnp() stub in worker.c (P0-12 placeholder)
- Declare both new functions in cluster.h and worker.h
- Add 5 recovery tests: empty state, snapshot lsn loading, WAL replay, corrupt
  sentinel rejection, latest-snapshot selection; all 23 controller tests pass

src/controller/include/cluster.h

@@ -39,6 +39,7 @@ extern int add_resource(void*, char*, char*, int, xce_order_t, int, int);
 extern int update_resvals(cluster_t*, worker_t*, int, xce_resval_t*);
 
 extern int load_jobs(void*);
+extern int restore_job(cluster_t*, uint64_t, const void*, size_t);
 extern int update_job(void*, uint64_t, xce_kv_list_t*);
 extern int do_job_started(void*, uint64_t, int, int*, int, int*);
 

src/controller/include/worker.h

@@ -9,4 +9,5 @@
 
 extern int add_worker(void*, endpoint_t*, const char*, hostattrs_t*);
 extern int restore_worker(void*, xce_worker_t);
+extern int worker_from_capnp(cluster_t*, const void*, size_t);
 #endif