Add EnsureIndices entry recovery barrier

[aaltshuler]

What & why

EnsureIndices now runs the RFC-0022 branch-aware, roll-forward-only recovery barrier before schema-idle checking, base capture, or index planning. This prevents a retry from planning or staging index artifacts against unresolved recovery state while retaining the final under-gate relist that closes the entry-to-effect race.

Backing issue / RFC

• Implements / is an accepted RFC: RFC-0022 unified write path

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes
• Public docs updated if user-facing surface changed (N/A; developer/current-truth docs updated)
• Reviewed against docs/dev/invariants.md — no Hard Invariant weakened and no deny-list item hit

Notes for reviewers

• Preserves the existing read-write-open roll-forward test for EnsureIndices v8.
• Adds same-handle coverage for a roll-forward-eligible EffectsConfirmed intent under its unchanged token.
• Keeps the authority-clean complete-effect Armed rollback cell isolated.
• Adds a two-table proper-prefix Armed cell proving RecoveryRequired is returned before remaining index staging; this test reaches the post-stage failpoint without the barrier.
• Refreshes write-path/testing/current-truth docs. The Append wording correction documents existing bare-Lance behavior only; strict insert remains RFC-0023 activation work.

Validation:

• cargo test --workspace --locked
• cargo test -p omnigraph-engine --locked --features failpoints --test failpoints (118 passed)
• cargo test -p omnigraph-engine --locked --test write_cost ensure_indices_manifest_reads_are_flat_in_history -- --exact
• scripts/check-agents-md.sh
• git diff --check

Greptile Summary

This PR adds an entry recovery barrier to EnsureIndices. The main changes are:

• Runs roll-forward-only recovery before schema checks, base capture, and index planning.
• Adds failpoint coverage for same-handle roll-forward and Armed recovery refusal.
• Updates developer docs for EnsureIndices recovery and current Append behavior.

Confidence Score: 5/5

This looks safe to merge after checking the new failpoint fixture.

• The production EnsureIndices barrier matches the existing branch recovery checks.
• The under-gate relist still closes the race before table effects.
• One added test may not set up the indexed schema state it expects.

crates/omnigraph/tests/failpoints.rs

Important Files Changed

Filename	Overview
crates/omnigraph/src/db/omnigraph/table_ops.rs	Adds the EnsureIndices entry recovery barrier before schema-idle checking and planning.
crates/omnigraph/tests/failpoints.rs	Extends EnsureIndices recovery tests, with one new fixture that may not create the expected index work.
docs/dev/writes.md	Documents the EnsureIndices recovery barrier and same-handle recovery behavior.
docs/dev/execution.md	Clarifies that Append does not fence existing committed ids today.
docs/dev/invariants.md	Updates the unique-constraints invariant for current Append key behavior.
AGENTS.md	Updates the capability matrix for EnsureIndices recovery and Append ingestion semantics.
docs/dev/testing.md	Refreshes the failpoint coverage map for the new EnsureIndices recovery tests.
crates/omnigraph/src/db/omnigraph.rs	Updates the recovery-barrier comment to include EnsureIndices.

_{Reviews (1): Last reviewed commit: "Add EnsureIndices entry recovery barrier" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - AGENTS.md (source)
• Context used - CLAUDE.md (source)