fix: run the frame-record gap backfill on every role, at runtime

[blacks1ne]

Base: 2b96656e

A non-archive never ran the frame-record gap backfill, and no node ran it after
bootstrap: run_all_gap_backfill sat behind if sync_archive_mode, spawned
once inside the bootstrap closure. Measured on a live mainnet regular — zero
gap scan / record-only lines in six hours.

The hole it would close is large and permanent. A wiped mainnet node holds
genesis at 244200, then whatever gossip delivers once it adopts the head (on
the node examined, 701050..=701741), and nothing in between — 456,849
absent frames. Forward-fill only climbs from its cursor, so the poller cannot
close it, and a regular's storage attestation anchors ρ_N to an exact global
frame that must be present locally. A state jump, a failed jump plus gossip
head adoption, and a restart all reach this shape. The scan already reported
it; nothing ran the scan.

#587 / #609 are the empty-store entry into the same end state, fixed at the
poller in quil-rpc. Disjoint files, either can land first.

Changes

• Every role, on a 10-minute loop. Bootstrap-only missed the runtime state
  jump entirely.
• Chunked descent (512), descending, so each chunk's parent_selector
  anchor is the record the chunk above just filled. run_record_only_backfill
  materializes (lo..=hi) and fetches serially — fine for a 3-frame restart
  leftover, not for 456k.
• Two floors. Genesis, because bootstrap_genesis writes that record on
  every node, making the range the scan reports beneath it fictional (244,199
  mainnet heights that never existed). And, on mainnet, the 2.1.0 flag day
  (669975): those frames were produced by pre-migration provers, so
  archive_frame_is_valid's genesis-prover allowlist drops every one — the
  archive serves the record, this node fetches it, then discards it locally.
• Non-archives bound the descent to three epochs below a gap's TOP — the
  slots a leaf-root registration retains ({prev, current, next}). From the
  top, because the heights needed soonest are those just under the records the
  node already has.
• Stop on filled == 0 && unresolved > 0, not filled == 0. A chunk the
  poller closed between the scan and the backfill also fills nothing, and
  stopping on that would abandon a fillable descent. Hence BackfillOutcome.
• Unresolved heights are tallied by cause. A frame this node rejected and a
  frame no peer holds were one indistinguishable number. unrecoverable is now
  unresolved (grep-visible), and the scan logs intended_frames beside
  missing_frames.

RESEED_GAP_BACKFILL_ENABLED is false today because an unbounded backfill
over unservable heights produced attempted=4970, unrecoverable=4970 — which
is why the bound and the stop rule are load-bearing.

Field result

Overnight on a wiped mainnet non-archive: ~29k records recovered descending
698605 → 669422, then a permanent stall at 669975 — the flag day, exact. The
chunk straddling it split at 669976/669975, filling the 470 heights above and
none of the 42 below. It was reported as an archive-side gap; the archives were
serving those frames correctly.

Tests

Eight red before, green after. The headline-count test reports 2160 without
the fix and 0 with it — 2160 is exactly the window the reporting node
stalled in. -p quil-node -p quil-store -p quil-crypto 190/190.

Not tested

The role gating and the rescan loop — archive_sync.rs has no harness for that
bootstrap closure. The live-node observation above is what measures them.