fix(sync): recover finalized VM and rewind partial graph cursors

[branarakic]

Summary

This stacks on #2275 and closes two gaps exposed by the 500 SWM / 500 VM Testnet workload:

• recover an asynchronous finalized VM publication when RFC-64 reconciliation has already retired its byte-identical SWM operation snapshot;
• rewind a raw durable responder cursor to the last verified complete-graph boundary after a timeout, and reset legacy sessions stranded at raw EOF ahead of their verified cursor.

User impact

Before, a publication could be finalized on-chain yet remain locally unresolved if RFC-64 snapshot retirement won the race, and a receiver could permanently miss one VM graph after accepting only a partial raw suffix.

After, the publisher reconstructs only a public, count-complete VM candidate and still verifies its Merkle root against the chain. The receiver retries discarded partial rows from the last authenticated graph boundary; an already-stranded EOF checkpoint starts a fresh immutable responder generation.

Safety boundaries

• VM recovery is public-only and requires the queued triple count before the existing chain-root verification repairs lifecycle state.
• Cursor rewind is bound to the completed metadata manifest and an exact graph-boundary prefix digest.
• Rejected or metadata-incomplete pages still delete the checkpoint and fail closed.

Validation

• Independent no-spend Testnet recertification: PASS.
• Source: 500/500 SWM and 500/500 VM exact.
• Independent local receiver: 500/500 SWM and 500/500 VM exact.
• Failures: 0. No new Testnet publishing or token spend during recertification.
• Run ID: recertify-open-20260814-c49e0-1a002891207.
• Focused cursor, graph materialization, and query-attribution lane: 54/54 passed.
• Agent build, type tests, package-root test, and diff check passed.
• Broad unit lane: 2,887 tests passed; its sole static attribution failure was repaired and the exact failed gate reran green. GitHub CI now supplies the clean-head full-lane result.

Evidence boundary

The live workload reproduced the publication race and the one-asset VM gap, and the complete branch recertified at 500/500. The old stranded responder session expired before the final sweep, so the explicit rewind/reset branches are proven by exact regression tests rather than by claiming a live reset log that was not observed.

[branarakic]

Live Testnet follow-up at 904dbc0: the first exact-head 500/500 run showed that a selected public SWM scope could complete before publication and then remain terminal while newer SWM assets arrived. This commit adds a bounded selected-only freshness pass on the existing reconciler cadence. It stays independent of broad sync-on-connect, never admits unselected graphs, and never marks the whole peer fresh. Local evidence: 55/55 reconciler tests, 73/73 selected-SWM lifecycle tests, agent build/type/package-root, and diff check all pass. I am now validating the exact commit on the same Testnet source and independent receivers.

[branarakic]

Exact head 41c5608 addresses the current selected-SWM freshness feedback. Local evidence: agent build/type/package-root green; 4 focused suites, 119/119 tests; diff check clean. The 20-SWM live proof on the preceding head published and converged 20/20, with the harness verdict inconclusive only because its observation sample was 12.78 seconds short of the configured floor. The next exact-head gate is 500 SWM + 500 VM with independent local and remote receivers.