Prepare resume history before activation and keep a recovery copy #2143

Parent: #1900

Problem

The resume changes the API history before it activates the record. A failure in between can lose the original history.

Scope

1. Finish all history reads and writes before the activation commit.
2. Save a recovery copy of the original history before the preparation write.
3. Restore the original history if activation is rejected. Restore only when the record is still interrupted.
4. For a denied pending action, persist the denial result before activation.

Out of scope

• Two resumes at the same time.
• Abort or abandon handling after the commit.

Done when

• A failed write or a rejected activation leaves the original history on disk.
• The recovery copy stays when the restore does not run.

Depends on

The interrupted-child resume sub-issue of #1900.