op-interop-filter: Validate startup history before advancing cross-unsafe

**Claude:** I found this during the interop implementation review.

Op-interop-filter trusts backfilled unsafe history without validating its executing messages.

Event sequence:

1. Startup records wall-clock timestamp `S` (`filter/service.go:161-165`).
2. Each ingester starts near `S - backfillDuration` (`logsdb_chain_ingester.go:379-394`).
3. Fresh ingestion targets `eth.Unsafe` and continues following that label (`logsdb_chain_ingester.go:528-575,463-501`).
4. An ingester becomes ready after its latest timestamp reaches `S` (`logsdb_chain_ingester.go:193-200`).
5. Once every ingester is ready, the validator stores `crossValidatedTs = S` (`lockstep_cross_validator.go:305-325`).
6. Startup never calls `validateTimestamp` for `S` or any earlier backfilled timestamp.
7. Forward validation begins at `S+1` (`lockstep_cross_validator.go:328-348`).
8. Cross-unsafe access checks accept source timestamps through `S` (`lockstep_cross_validator.go:213-223`).

This occurs on every process start because the cross-validated timestamp is memory-only.

It also undermines the documented recovery path. After a validation failure, wiping the data directory and restarting can backfill and trust the same invalid unsafe block.

Expected behavior: initialize from a trusted cross-unsafe anchor and validate every later timestamp. Do not derive the anchor from wall-clock time alone.