1.2.5 — Forge — Batch, recovery and persistence fixes

This update fixes Forge batch transfers around Tom rebuilds, fences unresolved recovery ownership, and improves persistence handling without changing the existing recovery model.

• Fixed Forge batch export stopping after Tom's periodic network rebuild. The fast path now invalidates immediately on clear, restores after an equivalent rebuild, and still stops when the topology really changes.
• Recommendations are limited to items that the current batch route can actually move. Tom-visible handlers rejected by the transfer route no longer produce suggestions that cannot move anything.
• When live and legacy forge-transfer recovery directories coexist, recovery, incident, hopper, and in-process unsaved records are inspected read-only. Pending or unreadable evidence blocks new batch transfers and preserves every copy for manual reconciliation.
• Shutdown now performs a bounded final snapshot wait and records the last successful generation. Timeouts cannot hang the server indefinitely, but the newest generation is not guaranteed to persist; logs and diagnostics report dirty state, last successful generation/time, and failure reason.
• Non-atomic filesystems retain at most two verified backups after a successful install. Startup tries backups from newest to oldest, so a damaged newest backup can still fall back to the next valid one.
• The hopper failure backoff default changed from [20, 40, 100, 200, 400] to [20, 40, 80, 120, 200], reducing the longest wait from about 20 seconds to about 10 seconds. Existing TOML values are not rewritten automatically; edit hopper.failureCooldownTicks if you want the new default.

Back up the world before updating. Minecraft 1.20.1, Forge 47.x, and Tom's Simple Storage 1.7.1 are required, and client/server DSC versions must match. 1.2.5 still uses a single SavedData file and does not yet provide per-record corruption isolation; a damaged record can make all volumes read-only. Bounded shutdown and non-atomic replacement cannot guarantee zero data loss. Cross-loader world conversion remains unverified.