engine: safely recover serial frontier staging attempts

[rbtr]

Summary

• Persist active frontier phase metadata in the Bolt-backed queue checkpoint.
• On restart, treat every in-flight staging attempt as invalid evidence: requeue its PRs for a fresh serial staging run.
• Delete only staging branches in Shunt's configured namespace, preventing checkpoint data from targeting another branch.
• Keep restored active candidates ahead of later pending candidates.

PRD alignment

This is the first implementation slice for docs/frontier-prd.md: deterministic serial recovery, durable active-candidate metadata, and safe invalidation across a restart. It does not add speculative fan-out, a Postgres schema change, or deployment-specific behavior.

Validation

• make lint test build
• primary LSP diagnostics
• independent review of the final diff
• git diff --check and public-copy scrub

[rbtr]

This PR used the wrong delivery plan. The existing PR stack will receive the required changes.