fix: close the recovery crash window that lost WAL recovered data

[nepinhum]

What this changes

Open published the new journal number in the manifest before the recovered memtable reached a table.
Once CURRENT named that manifest, recovery skipped every older journal and a crash in between lost the
recovered data while its journal was still on disk. The table is now written first and one manifest record names
both it and the new journal. A crash before that record leaves the old manifest, which still names the old journal,
and the next open replays it.

Open also no longer rotates the journal twice since the recovery flush it used to call did that itself.

mark_file_num_used keeps the file number allocator past a journal that an earlier open created but never recorded, matching upstream's MarkFileNumberUsed. Such a journal otherwise kept its number in use on disk where the manifest could hand it out again and stayed above every later journal number. Recovery replayed it on every open and never removed it.

How it was checked

v fmt -verify .
v vet .
v test .
v run examples/smoke

Checklist

- [x] v fmt -w . ran
- [x] Tests pass
- [ ] A new module carries a README.md — n/a