fix(pager): bound the free-list scan to a fixed window per commit

Loading and rewriting the whole durable free-list chain on every write
made both the buffer-pool residency and the commit's IO scale with the
number of free pages in the store, defeating the bounded-memory budget
on the hottest path in the system.

begin_write now materialises only a fixed window of the chain
(read_chain_prefix / ChainWalk), the allocator cache is loaded from
that window alone, and the following commit rewrites just the window
and splices the fresh pages onto the untouched retained tail. Callers
that need the full entry set (follower reclaim fold, rekey's page
walk, fsck-style checks) stream the chain page-by-page instead of
materializing it. The free-list module is split into a directory
(layout/read/write/budget) along the way, and gains crash-boundary and
windowed-rewrite regression coverage.

Author: farhan-syah

.config/nextest.toml

@@ -14,6 +14,7 @@ test-threads = "num-cpus"
 [[profile.default.overrides]]
 filter = """
     binary(crash_basic)
+    | binary(crash_boundaries)
     | binary(recovery_basic)
     | binary(fsck_deep)
     | binary(durability)

src/btree/tree/core.rs

@@ -206,8 +206,14 @@ impl<V: Vfs> BTree<V> {
 
     /// Wire in the `Db`'s shared free-page cache. After this call,
     /// `allocate_page` pops from the shared pool before bumping `next_page_id`.
-    /// The pool is loaded at `begin_write` with the durable free-list's
-    /// floor-safe pages, so recycling from it is always snapshot-safe.
+    /// The pool is loaded at `begin_write` with the floor-safe pages of the
+    /// bounded free-list window the following commit rewrites, so recycling
+    /// from it is always snapshot-safe.
+    ///
+    /// The pool is draw-only: nothing here may push into it. The commit deletes
+    /// a recycled id from the chain by finding it in that window, so an id
+    /// pushed in from elsewhere would be handed out while the unscanned tail
+    /// still named it — the same page id given to two live structures.
     pub fn set_free_page_cache(&mut self, cache: Arc<parking_lot::Mutex<Vec<u64>>>) {
         self.free_page_cache = Some(cache);
     }