Add batched ingestion with durable WAL and replay-safe Lance sink

[beinan]

Add a bounded ingestion module that separates session history loading, ordered alignment, durable WAL publication, and independently batched checkpoint/table consumers. Bulk mode collects original source cohorts until their boundary or count/byte/memory limits, avoiding a WAL per small timed flush. Required recovery prefixes can flush independently, so recovering evicted speculative session state cannot wait on its own batch.

Deduplication covers committed and pending receipts; rows, state deltas and receipts share one durable entry. Cancellation/restart replays committed work, and ACKs wait for every durable prefix. The optional Lance sink atomically commits rows and input coverage with Lance 2.2/Zstd. Application adapters, process ownership, source fan-out and WAL reclamation remain integration responsibilities; the optional backlog limit bounds unconsumed segments, not retained storage.

Validation: 46 default tests pass, including batch boundaries, same-batch duplicate receipts, conflicting retries, cancelled partial admission, restart recovery, byte/count/memory limits and recovery-prefix flushing. All-target Clippy and formatting pass. Real Lance sink/fault tests passed in the composed integration workspace. No production throughput claim; private adapters, configuration, credentials and production data are excluded.