Legacy version fallback fails offline replay when a step already occupies the marker position #641

Version: workflow 2.4.5, SDK 2.1.6.

A workflow history recorded before a new patched() call continues correctly through WorkflowExecutor, but ReplayDiff::diffExport() reports shape_mismatch for the same history. QueryStateReplayer asserts a version-marker shape before VersionResolver can return the legacy default. The legacy default records no marker and does not advance the workflow sequence, so the existing activity or timer at that position is valid.

Reproduction:

1. Record an embedded workflow history that completes an activity and waits on a timer.
2. Add patched('change-id') before an already-recorded activity or timer, retaining the old branch when it returns false. Ensure the workflow definition fingerprint changes.
3. Import the original bundle and continue with sticky execution disabled. The runtime keeps the old branch and completes.
4. Run ReplayDiff::diffExport() against the unchanged bundle. It returns drifted, reason=shape_mismatch, expected_shape=version marker, with the original activity/timer event types at that position.

Expected: offline replay applies the same conservative fallback as the runtime and matches the existing step.

Source: QueryStateReplayer, lines 325-334 asserts first. WorkflowExecutor, lines 704-734 resolves first and asserts only when advancesSequence is true.

Suggested fix: resolve the version before asserting its shape in QueryStateReplayer; assert only when the resolution occupies a history slot. Add a frozen pre-marker offline replay regression while retaining malformed-marker and genuine step-drift refusals.