[B1] Crash-safe rewind: journal originals before applying workspace restore

[dennisonbertram]

[parent] #1337

Problem

RestoreRewindPoint writes files before tx open (~719-731); crash mid-loop corrupts file↔history correspondence.

Outcome

Journal originals before applying restore; idempotent w.r.t. crash between file apply and DB truncate; second attempt completes.

Acceptance criteria

• Injected mid-loop failure leaves recoverable state; retry completes correctly.

Test-first plan

Test: injected mid-loop failure then recovery (expected red).

Impact analysis

Rewind path only; atomic from API consumer view.