feat: frame TP WAL into per-commit records with validated recovery

[zhanglei1949]

Fixes #832

Summary

Reframes the TP WAL from the legacy per-append 8-byte header into a self-describing framed format where one commit = one complete frame, and replaces best-effort recovery with a validate-before-replay protocol with typed errors. P1-2 of the explicit transaction support track.

New on-disk format (v1)

FileHeader (24B)
  magic / format_version / header_size / writer_slot_id / reserved
Frame* (one frame per committed transaction)
  FrameHeader (24B): magic, record_kind, header_size,
                     commit_timestamp, payload_length
  payload              # redo bytes; empty only for compaction frames
  FrameTrailer (8B):   commit marker, CRC32C over header + payload + marker

All fields are serialized little-endian byte-by-byte (host-endianness and struct-layout independent). The frame CRC covers the whole frame header, payload and commit marker in a single pass, so kind/timestamp/length are protected as well.

Key behaviors

• Marker-last commit protocol. The trailer (with the commit marker) is written after header + payload; a present trailer proves the frame was fully persisted.
• Failed-frame rollback. A write failure mid-frame truncates the file back to the clean logical EOF, so partial residue can never be buried mid-file by a later commit.
• Real logical EOF. Files are no longer preallocated to 1 GiB; anything after the last complete frame is torn-write residue.
• Validate-first recovery. All *.wal files of the current checkpoint are parsed and checksummed up front; frames from all writers are merged by commit_timestamp and replayed in global order. Errors are typed (unsupported_format / corrupted_frame / duplicate_timestamp / unknown_record_kind) and carry path + offset + timestamp. Only an incomplete trailing frame (an uncommitted crashed transaction) is discarded; any earlier inconsistency is a hard error.
• Record kinds: kInsert / kCowUpdate / kCompact. AP/embedded paths write no WAL; checkpoint-only transactions emit an empty-payload kCompact frame.

Compatibility note

WAL files written in the old per-append format are rejected during recovery as unsupported_format; no migration path is provided. Any deployment upgrading with live TP WAL data should consolidate it via a checkpoint first.

Verification

• wal_codec_test: 18/18 passed (round-trip, tamper rejection, crash-injection subprocess tests: crash at each write phase leaves only committed frames, replay across compaction, bit-flipped payload rejected).
• transaction_test: 121 passed, 0 failed (3 pre-existing conditional skips), including the new TP-commit/replay-after-compaction e2e cases.
• tp_index_test: 15/15 passed.
• clang-format --dry-run -Werror clean on all changed files.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.