Routine scheduler can fire after a failed durable commit

Routine firing advances the next run before it starts unattended work. The scheduler hides a failed storage write. It can then start work without a durable advance. A service-worker restart can repeat the same side effect.

Related storage writes are not ordered. An older write can finish last and restore removed or stale state. Cold-start mutations can also race durable hydration.

Expected behavior:

• Hydrate state before a mutation.
• Serialize durable writes.
• Do not fire if the durable advance fails.
• Roll back the live schedule and re-arm the alarm after failure.
• Stop, disable, or remove must prevent a queued fire.
• Enforce the routine limit after hydration.

Start at the routine scheduler, durable storage writes, hydration, and service-worker alarm handling described in the issue. Reproduce failed and out-of-order writes, cold-start mutation races, and queued fires after stop or disable. Done means hydration precedes mutation, writes are serialized, failed advances roll back and re-arm the alarm, stopped routines cannot fire, and limits are enforced after hydration.