cow: resume-cursor chain-log ingestion so no watch is lost to downtime

[mfw78]

Watch-tower harvest car. Derives from src/services/chain.ts (cold backfill from deploymentBlock, per-page lastProcessedBlock persistence). Blocks #657.

A missed ConditionalOrderCreated is silently permanent: the module's two chain-log rows do not declare resume, so a fresh or restarted subscription starts at head, and the #659 reconcile sweep cannot resurrect keys it has never seen. Declare durable cursors and a deploy-block cold start.

Why

Watch-tower survives restarts by backfilling from the registry deployment block and persisting its cursor per page; that operational lesson outlives its revert machinery. The Rust-native shape is manifest wiring, not a port: nexum-runtime already ships resume: bool plus max_lookback on chain-log rows with a durable per-subscription cursor and at-least-once redelivery (verified in manifest/types.rs and runtime/event_loop.rs). One real gap remains: a fresh resume subscription still starts at head; there is no start-block field.

Scope

• Declare resume on both chain-log rows in module.toml (and the mainnet variant cow: rename twap-monitor to ccow-monitor and enable mainnet #657 lands); handlers tolerate redelivery, idempotent via the (watch, uid) journal and log-position stamp per cow: reorg-aware ingestion and submission-policy pass #654.
• Cold start: initial cursor = the registry deployBlock from the fork's deployments/networks.json (cc#66; gate on it, do not assume it merged). If this needs a manifest start_block, file the [Upstream nexum-runtime] rider in the [Upstream nexum-runtime] Capability escape: omitting [capabilities] grants unrestricted host-import access #645-650 style.
• Cursor validity tied to watch-set presence: an empty watch set with a non-genesis cursor forces re-backfill instead of trusting the cursor.
• Restart-gap test: engine down for ten minutes of blocks across a Created, restart, the watch exists.

Done when

• Both chain-log rows declare resume; redelivery is a no-op, with a test.
• Cold start backfills from the deploy block, not head, with the upstream rider filed if required.
• Empty-watch-set plus non-genesis cursor triggers re-backfill, with a test.
• The restart-gap test is green: no Created lost across downtime.

Blocked by: #652, #654.

Blocked by: #652, #654.