store: set aside a torn last journal line on open; server waits for lock

A crash or power loss mid-append can leave a partial last line. The
writer acknowledges an append only after its whole line is synced, so
that line was never acknowledged: opening now saves those bytes to
journal.jsonl.torn.<time>, truncates to the last newline, and journals
journal.tail_repaired (replay and projection ignore it; the GUI shows
it; books.digest reports it in journal_repairs). Damage before the last
newline is still corruption and still refuses to open. Tested at every
byte of the last append.

The MCP server now waits up to ten seconds for the writer lock: a
restarted server (a client reconnecting) raced the exiting one and died
with Locked, which also made mcp_schedules_and_recurring_over_stdio
flaky. The test harness now waits for each server to exit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

docs/receipt-store.md

@@ -23,7 +23,13 @@ easily backupable, journable":
   journal file plus the blob directory. Plain files, no WAL-file timing
   windows, no special backup API. A torn tail from a mid-copy is detectable
   (the last line fails hash/parse) and recoverable (truncate to the last
-  good seq — the projection never saw it). Better: the journal is
+  good seq — the projection never saw it). The live journal recovers the
+  same way on its own: an append cut off by a crash or power loss (bytes
+  after the last newline) was never acknowledged, so opening the books
+  saves those bytes to `journal.jsonl.torn.<time>`, truncates to the last
+  newline, and journals a `journal.tail_repaired` line; `books.digest`
+  reports it. Damage before the last newline is corruption and still
+  refuses to open. Better: the journal is
   git-friendly, so an optional `wanderbooks backup` that commits it to a
   private git repo gives versioned, distributed, deduplicated backup with
   full history.