Preserve storage offsets when replaying nested subquery moves

[joshdchang]

Summary

This is a focused follow-up stacked on #4681. It preserves authoritative shape-log offsets while replaying missed materializer moves, fixing nested subquery dependencies whose generated control messages and spliced move-in rows do not contain lsn / op_position JSON headers.

Problem

#4681 correctly persists each outer consumer's per-dependency move position and asks the dependency materializer to replay the missing range after restart. The initial decoder reconstructs each replay offset from JSON headers, however:

• generated move-in / move-out controls have no source LSN headers;
• spliced move-in snapshot rows have no source LSN headers;
• snapshot-end controls may occur between visible replay records;
• shape-log offsets are sparse, so incrementing the previous visible offset is not authoritative.

Nested materializers can therefore emit a replayed move with the wrong position, advance the outer cursor incorrectly, and miss a later move after another restart.

Changes

• Add an optional get_log_stream_with_offsets/3 storage capability.
• Preserve exact offsets through in-memory storage and PureFileStorage's ETS, disk, hibernated, and mixed disk/ETS paths.
• Give the new reader strict lower-exclusive / upper-inclusive bounds while retaining legacy get_log_stream/3 chunk behavior.
• Reconstruct the materializer seed exactly at the persisted dependency cursor and lazily replay only the missing tail.
• Stop bounded disk reads immediately at the inclusive max instead of scanning the remainder of the file.
• Fail with a clear storage capability error for custom adapters that do not implement offset-preserving replay.

The storage format and HTTP Shape API are unchanged.

Tests

• storage conformance for snapshots, sparse ordinary records, generated controls, spliced move-in rows, live ETS, disk after hibernation, and mixed disk/ETS bounds;
• read-count regression proving a bounded disk stream stops after its max;
• materializer seed/replay tests for offset-less move-out controls and move-in rows;
• repeated three-level nested subquery move-out/move-in oracle across three restarts;
• existing 200-transaction restart catch-up oracle.

Locally passed:

• mix format --check-formatted
• mix compile --force --warnings-as-errors
• 206 focused storage/materializer/consumer tests on the Sapien integration branch
• full sync-service suite
• restore oracle suite
• 100-shape / 500-mutation property oracle

This PR is intentionally based on rob/restore-subqueries-bug-5, so its diff contains only the nested-offset follow-up and can be folded into #4681 independently of Sapien's fork.