fix(storage): validate checkpoint source offsets

[siriusctrl]

Review finding

The decoder accepted line_end values that produced gaps or overlaps relative to the prior decoded line. The async forward reader naturally supplies contiguous offsets, but the public crate-internal tail-candidate seam could otherwise publish incorrect raw source offsets and committed boundaries.

Fix

• track the next expected physical line offset and reject gaps, overlaps, and underflow
• verify a multi-record checkpoint remains hidden across repeated EOF observations and publishes exactly once after later appends complete it
• exercise deterministic 1-23 byte read chunks, exact raw order, arbitrary m900 candidate offsets, and a very large declared checkpoint count without preallocation

Independent validation

• cargo fmt --check
• cargo check --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets: 276 passed, 0 failed, 0 ignored

This PR is based on agent/checkpoint-decoder and should be merged there before PR #2. It does not add epoch, truncate, replacement, or reopen behavior to the forward decoder.