fix: isolate operation ledger recovery

[GQAdonis]

The installed service could time out a ledger query on the same WebSocket used by ordinary storage, then broadly retry executor failures while trying to recover. This change opens a separate server-mode ledger transport before the first query, preserves the embedded in-process path, serializes generation replacement, and limits retries to a typed recovered stale-ledger deadline.

The focused regressions exercise concurrent initialization, overlapping replacement, replacement failure, startup retry, the actual coordinator drain branch, executor-error exclusion, and ordinary storage responsiveness during four real server-mode query cancellations.

Validation:

• cargo fmt --all --check
• git diff --check
• cargo check --locked --package surreal-memory-server --no-default-features --features server-only
• cargo test --locked --lib operations::tests:: -- --nocapture — 17 passed
• cargo test --locked --test operation_query_deadline --no-default-features --features server-only -- --nocapture — 1 passed
• cargo test --locked --test executor_recovery -- --nocapture — 4 passed
• strict OpenSpec validation for all touched changes
• Rust auditor format, enforcement, and inventory gates — clean
• isolated critic round 2 — PASS

The dependency audit still reports the same three advisories present in the committed baseline lockfile; cargo-deny is not installed. Deployment and backlog-drain certification remain a separate task after merge.