Add tiled tree recovery API

[Amaury Chamayou (achamayou)]

Summary

• add TiledTreeT::resume for an existing namespace, serialized tree state, and a caller-validated full-tile boundary
• add TiledTreeT::from_frontier so logical recovery can complete before any tile namespace is ready
• add TileWriterT::repair for detached/background namespace population or repair after an explicit trusted prefix
• add monotonic adopt_tile_prefix after the detached writer is quiesced
• preserve trusted tiles while replacing stale or untrusted suffix files at every tile level
• preserve existing fresh-tree and ordinary TileWriter scan/repair behavior
• harden TreeT deserialization for bounds, exception safety, large compacted frontiers, allocation limits, and maximum capacity
• document ownership, concurrency, checkpoint, repair, adoption, and failure contracts

APIs

auto resumed = TiledTree::resume(
  config,
  hash_algorithm_short_name,
  serialised_tree,
  full_tile_boundary);

The caller establishes namespace ownership and validates every tile below the boundary as belonging to the serialized tree. Proof reads are capped at that boundary until later flushes publish more tiles.

auto recovering = TiledTree::from_frontier(
  config,
  hash_algorithm_short_name,
  serialised_tree);

TileStore repair_store(config.prefix, hash_algorithm_short_name);
auto repair = TileWriter::repair(repair_store, trusted_boundary);
repair.write_up_to(target_size, authoritative_leaf_at);

// After the repair writer is quiesced:
recovering.adopt_tile_prefix(target_boundary);

from_frontier performs no namespace I/O and trusts no tile files. Root computation and appends are available immediately. If old leaves are non-resident, tile-dependent proofs and live flushing fail until a complete repaired prefix overlaps the resident frontier.

The detached writer may run on a background thread; merklecpp does not create or manage threads. The application must serialize writers sharing the namespace and quiesce repair before adoption. Adoption verifies the boundary seam, updates flushed and immutable boundaries together, and continues to distrust the suffix.

Validation

• exact CI reproduction in WSL: Debug Clang, OpenSSL enabled, integrated clang-tidy, all three public-header checks, and 22/22 tests passed
• WSL GCC full short suite: 20/20 tests passed
• WSL targeted clang-tidy build: tiles_resume, tiles_writer, and tiles_tree
• WSL trace-enabled build and tests: tiles_resume and tiles_writer
• lifecycle coverage for frontier-only restore, no-I/O construction, guarded proof/flush behavior, detached repair, incremental repair, adoption, monotonicity, resumed growth, and stale suffix replacement
• final read-only code review found no remaining high-confidence defects