payout: make in-flight payments survive a restart

The exec queue was memory-only, and FlushMaturePayouts erased a matured entry
from pending_payouts.json *before* handing it over. Any restart in that window
lost those payments with no record that anyone was owed anything. It was not
hypothetical: a container restart on 2026-07-30 silently dropped a backlog of
~1,156 BTF, and there was nothing left to reconstruct it from.

Re-queueing blindly would have double-paid whoever had already been sent to,
so the payment needs to be idempotent rather than merely persistent.

In-flight work is now a persisted list of per-payment records
(paying_payouts.json), one per (block, address) -- the granularity SendMoney
works at, and therefore the granularity at which a payment can be half-done
when the process dies. Records are written, via a temp file and rename so a
crash cannot truncate them, *before* the ledger entry is erased, so the debt
is always described by at least one of the two files. Each attempt updates the
record (retries, deferrals, backoff); settling it removes the record and
rewrites the file, which is what stops a restart from paying twice.

On startup ReconcilePayouts runs before the payout thread:
  - a record whose payment the wallet already shows -- matched on the payout
    comment plus the exact amount and destination -- is dropped, not resent.
    SendMoney commits the transaction to the wallet before it returns, so a
    crash immediately after sending is recoverable.
  - a ledger entry that has already been exploded into records is dropped,
    which is the crash-in-the-window case where both files describe one debt.

The wallet check is deliberately biased towards "already paid": skipping a
payment is visible in the log and recoverable, paying twice is neither.

Verified live: sampling paying_payouts.json during a payout burst caught 3
records / 18.56 BTF mid-flight, cleared once paid, and the paid lines now
carry the txid.

(cherry picked from commit d0248f2e65dbe745f2e9b1d09e1f53a4354d3640)

0 files changed, 0 insertions, 0 deletions