fix(restore): accept checksum-tracked LTX

[corylanou]

Description

Accept checksum-tracked LTX chains in restore compaction while preserving legacy NoChecksum behavior when the final input file uses it. Apply the same restore contract to standard replica restores and VFS hydration, with regression coverage for snapshot-plus-incremental chains.

Motivation and Context

Valid checksum-tracked LTX files pass verification, but restore previously forced the output header to NoChecksum while retaining a nonzero final post-apply checksum. Trailer validation then rejected the chain with "post-apply checksum not allowed".

This change derives the output checksum mode from the final input header, matching the trailer selected by the LTX compactor.

Fixes #1427

How Has This Been Tested?

• go build ./...
• go build -tags vfs ./...
• go test -race -tags vfs . -count=1
• go test -race ./... -count=1 (all non-root packages passed; the transient root-package failure passed on immediate isolated rerun)
• Repository pre-commit hooks: formatting, imports, vet, and staticcheck
• Focused checksum-tracked restore regression tests for standard and VFS restore paths

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project (go fmt, go vet)
• I have tested my changes (go test ./...)
• I have updated the documentation accordingly (if needed)

[github-actions]

PR Build Metrics

⚠️ Attention needed — Go toolchain outdated (1.25.13 → 1.25.14)

Check	Status	Summary
Binary size	✅	37.16 MB (0.0 KB / 0.00%)
Dependencies	✅	No changes
Vulnerabilities	✅	None detected
Go toolchain	⚠️	1.25.13 → 1.25.14 available
Module graph	✅	1230 edges (0)

Binary Size

	Size	Change
Base (63225f1)	37.16 MB
PR (f00140a)	37.16 MB	0.0 KB (0.00%)

Dependency Changes

No dependency changes.

govulncheck Output

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 1 vulnerability in packages you import and 3
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

Build Info

Metric	Value
Build time	38s
Go version	go1.25.13
Commit	f00140a

---

_{🤖 Updated on each push.}