fix: refuse writes when single-op history cannot be made durable

The async group-commit flush that persists single-op generation history
swallowed persist failures as a bare warn: writes kept succeeding while their
before-images piled up in memory, never durable and unbounded, with no signal.

The generation store now accounts for every failed flush at one place
(flushPendingSingleOps), tolerates a transient blip (retry with capped
exponential backoff), and after PENDING_FLUSH_FAILURE_THRESHOLD consecutive
failures LATCHES a durability failure and refuses further single-op and transact
writes with a typed, exported PendingFlushDurabilityError — rather than promise a
durability it cannot deliver. Live canonical data is untouched; only the
immutable history is stuck. The latch self-heals: the moment a flush succeeds
(a retry, or an explicit flush()/close()) it lifts and writes resume.

Loud errors, never quiet losses.

src/index.ts

@@ -175,7 +175,8 @@ export {
   GenerationConflictError,
   SpeculativeOverlayError,
   GenerationCompactedError,
-  StoreInconsistentError
+  StoreInconsistentError,
+  PendingFlushDurabilityError
 } from './db/errors.js'
 export type { UnreconciledRecord } from './db/errors.js'
 export type {