feat: implement persist_recover with snapshot load and WAL replay (P0-4)

- Add load_snapshot(): reads P0 sentinel ("XCESNAP\0" + lsn), validates magic,
  extracts checkpoint_lsn
- Add replay_wal(): scans seg-*.wal files in LSN order, skips entries <= from_lsn,
  verifies CRC chain, stops on mismatch, applies entries via apply_wal_entry() stub
- Add persist_recover(): find latest .capnp snapshot, load it, replay post-checkpoint
  WAL, retention pass (no-op in P0)
- Fix trim_wal_segments(): compare against active segment start LSN (not checkpoint_lsn)
  to avoid deleting the currently-open segment and losing post-checkpoint WAL entries
- Add restore_job() stub in job.c (P0-12a placeholder)
- Add worker_from_capnp() stub in worker.c (P0-12 placeholder)
- Declare both new functions in cluster.h and worker.h
- Add 5 recovery tests: empty state, snapshot lsn loading, WAL replay, corrupt
  sentinel rejection, latest-snapshot selection; all 23 controller tests pass

src/controller/job.c

@@ -61,6 +61,18 @@ int load_jobs(void* c)
     return 0;
 }
 
+/* P0 stub — full deserialization wired in Task 15 (cluster wiring).
+ * Inserts a job at its original jobid without allocating a new one.
+ * Returns -EEXIST if jobid already present (safety guard for replay). */
+int restore_job(cluster_t* c, uint64_t jobid, const void* capnp_payload, size_t len)
+{
+    (void)c;
+    (void)jobid;
+    (void)capnp_payload;
+    (void)len;
+    return 0;
+}
+
 static int get_nslots_in_alloc(xce_host_alloc_t* alloc)
 {
     int i;