Fix nested subquery move replay across restarts

[joshdchang]

Summary

Integrates Electric's restart-replay work from electric-sql#4681 into the Sapien fork and fixes nested dependency replay when generated control records and spliced move-in rows do not encode their persisted log offsets.

Linear: SAP-7363

Root cause

The dependency materializer reconstructed replay positions from JSON headers. Ordinary replication records contain an LSN and operation position, but generated move controls, snapshot-end controls, and spliced move-in rows do not. Nested materializers therefore tagged replay with the wrong cursor and outer shapes could miss dependency move-ins or move-outs after restart.

Changes

• Add an optional storage capability that streams main-log records with their authoritative persisted offsets.
• Preserve exact sparse offsets through in-memory, disk, hibernated, and mixed disk/ETS reads.
• Reconstruct the dependency seed at the outer consumer's persisted cursor, then lazily replay only the strictly bounded missing tail.
• Persist and commit per-dependency move positions only after the corresponding outer-shape writes are durable (from upstream Restore subquery shapes correctly after a server restart (materializer move replay) electric-sql/electric#4681).
• Add repeated three-level restart, generated-control, move-in-splice, sparse-boundary, early-halt, and storage compatibility regressions.
• Preserve the Sapien fork's infinite materializer subscription timeout.

No on-disk format, database schema, HTTP Shape API, or model behavior changes.

Verification

• mix format --check-formatted
• mix compile --force --warnings-as-errors
• 206 focused storage/materializer/consumer tests
• full sync-service test suite
• restart oracle: ordinary dependency, 200-transaction catch-up, and repeated three-level nested move-out/move-in
• property oracle: 100 shapes, 500 mutations
• hostile follow-up code review: no remaining findings

The inherited PR matrix will additionally run PostgreSQL 14/15/17/18, oracle, performance, formatting, and Lux checks.

Rollout

This PR does not publish an image while it is open. After review and green CI, merging to sapien/shape-startup publishes the multi-architecture Sapien image. Sapien Core will pin the resulting immutable digest only after its disposable exact-citation restart harness passes. Rollback is the prior digest; storage format remains compatible.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[joshdchang]

CI triage: the red checks are fork infrastructure failures, not test failures.

• PostgreSQL 14/15/17/18, oracle, and performance jobs stopped while pulling the fork-private ghcr.io/ai-sapien/electric/postgres:* images with a workflow token that has only contents: read (denied before checkout/tests).
• TypeScript test commands completed; their jobs failed afterward because this fork has no Codecov token.
• TS formatting fails on the pre-existing fork-only .github/workflows/sapien-sync-service.yml, outside this PR's diff.
• Elixir formatting/compilation and Lux both passed.

Equivalent sync-service coverage passed locally: warnings-as-errors compilation, 206 focused tests, the full suite, repeated nested restart oracles, 200-transaction catch-up, and the 100-shape/500-mutation property oracle. The stacked upstream-only PR is electric-sql#4699 and will receive the upstream repository's normal matrix once a maintainer approves fork workflows.