Swap/recovery: second-pass fixes from the follow-up review

- Recovery works when another named buffer is current. On that path
  OpenFile's NotifyFilenameChanged deleted the journal (old path ==
  new path) that was about to be replayed; the swap was lost and the
  file opened without the edits (pre-existing).
- After recovering from a journal with a torn final record, the torn
  bytes are truncated before the session appends to it (ReplayFile now
  reports the valid prefix length). A journal that recovers nothing is
  removed instead of appended to.
- Reload restarts the journal; recovery used to replay the edits the
  reload discarded.
- Opening a file that is already open switches to its buffer (in
  OpenFile and before the recovery check). Two buffers for one file
  interleaved records in one journal, and closing either unlinked it.
- Swap file names escape '!' and '%', so distinct paths no longer
  share a journal ('/x/a!b' vs '/x/a/b'). Swap files for paths that
  contain those characters get new names.
- The gap flag is cleared when the journal restarts, and a gap that
  cannot be closed (buffer too large to checkpoint) is reported once.
- crc32's table is initialised thread-safely; writer-thread error
  reports identify the buffer by journal path instead of racing on
  Buffer::Filename(); Close() no longer retries on EINTR (the fd is
  already released and may have been reused).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

SyscallWrappers.h

@@ -12,11 +12,10 @@ namespace syscall {
 // Automatically retries on EINTR.
 int Open(const char *path, int flags, mode_t mode = 0);
 
-// EINTR-safe wrapper for close(2).
+// Wrapper for close(2).
 // Returns 0 on success, -1 on failure (errno set).
-// Automatically retries on EINTR.
-// Note: Some systems may not restart close() on EINTR, but we retry anyway
-// as recommended by POSIX.1-2008.
+// EINTR is treated as success and never retried: the descriptor has already
+// been released on Linux, and retrying could close an unrelated, reused fd.
 int Close(int fd);
 
 // EINTR-safe wrapper for fsync(2).