op-interop-filter: Serialize cross-unsafe validation with reorg recovery

**Claude:** I found this during the interop implementation review.

Automatic reorg recovery can race with active cross-unsafe validation and restore a stale watermark.

This requires `--reorg-recovery-enabled`, which is disabled by default.

Event sequence:

1. `advanceValidation` passes its one-time ingester checks (`lockstep_cross_validator.go:300-318`).
2. It captures the old watermark and minimum ingested timestamp (`lockstep_cross_validator.go:315-328`).
3. An ingester detects an unsafe-head hash mismatch and records `ErrorReorg` (`logsdb_chain_ingester.go:488-605`).
4. Recovery rewinds the LogsDB to finalized (`backend_reorg_recovery.go:29-69`).
5. Recovery resets `crossValidatedTs` to the finalized timestamp (`backend_reorg_recovery.go:41`).
6. The active validation loop continues from its old local timestamps.
7. Post-finalized queries now exceed the rewound LogsDB tip and return an empty message list (`logsdb_chain_ingester.go:326-337`).
8. Validation treats those timestamps as message-free and stores the stale later watermark (`lockstep_cross_validator.go:330-348`).
9. The ingester restores canonical blocks, but the restored range is not validated again.

This affects op-interop-filter's cross-unsafe transaction admission. Op-supernode still verifies blocks independently before safe-head promotion.

Expected behavior: serialize watermark advancement with recovery, or use a generation check that cancels stale validation work after a rewind.