Add strict raw-log salvage workflow

[frahlg]

What changed

• add ftw salvage <damaged-store> <absent-target> with versioned ftwdb-salvage-v1 JSON
• share the raw-log replay checks with normal recovery while keeping recovery behavior unchanged
• recover only the longest contiguous, fully checked frame prefix and stop at the first fault
• open only active.wlog through a no-follow source directory descriptor under a shared lock
• ignore all manifests and rollups and publish empty derived-data directories
• reuse hidden staging, snapshot CRC32, read-only checks, atomic no-clobber publication, and identity-bound rollback
• extend the sanitized fixture and Linux NBD power-loss drill with checked salvage

Safety contract

Salvage requires a valid FTWDB-v1 database header. Every frame or transaction fault after that header yields a verified partial result and exit code 0. Header, open, lock, source-race, check, or publication errors use exit code 1 and publish no target when rollback succeeds.

The scanner never searches for another WBAT marker. It cannot recover valid frames after the first damaged frame. A complete final frame with a bad CRC counts as damage. CRC32 detects accidental changes; it does not provide authentication.

An existing target, including an empty directory or dangling symlink, remains unchanged.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features --locked --offline -- -D warnings
• cargo test --all-targets --all-features --locked --offline
• cargo test --doc --all-features --locked --offline
• emulator format, Clippy, build, and 11 tests
• shell syntax checks
• sanitized fixture: 889,978 points, 89 commits, CRC32 9ff1a95b
• OrbStack full-disk gate: checked 770,000-point, 77-commit prefix after ENOSPC
• OrbStack NBD power-loss gate: restore and salvage passed; salvage discarded the seven-byte tail and preserved 889,978 points, 89 commits, CRC32 9ff1a95b, and the clean raw-log SHA-256

Physical target-board and SD-card power cuts remain a release gate.