Derive incremental LoFi polling watermarks from sync timestamps

[rwjblue]

Context

Sidecar sends its incremental watermark as syncedSinceMillis, but currently derives that watermark from each QSON record's updatedAtMillis in src/main.rs.

Those fields represent different timestamp domains. Mixing them can cause changes to be missed or repeatedly fetched.

Scope

• Confirm the observed LoFi synchronization timestamp semantics using synthetic fixtures and the documented client contract.
• Derive incremental QSO polling watermarks from syncedAtMillis or authoritative server sync metadata.
• Define inclusive-boundary and missing-timestamp behavior.
• Keep the watermark transactional with normalization and last-good-state persistence.

Acceptance criteria

• A syncedSinceMillis query is never populated from updatedAtMillis.
• Inclusive-boundary duplicates are handled idempotently by QSON UUID.
• Contacts, updates, and tombstones advance through the same synchronization pipeline.
• The watermark advances only after normalization and last-good persistence succeed.
• Changing operations resets the watermark.
• Missing or incompatible sync timestamps fall back safely without silently skipping records.
• Synthetic tests cover new contacts, updates, tombstones, equal timestamps, selection changes, and failed persistence.
• No cursor or private record values appear in logs or diagnostics.

Related work

Resolve this before or during migration to the shared lofi-client so the existing timestamp mismatch is not carried into the new adapter.