Fix EventQueue losing state on persistence failures

add_event and event_handled mutated the in-memory queue before the
mutation was durably persisted. A failed or delayed persist could
then cause duplicate events on replay, silently skipped
acknowledgements, or resurrected/lost events after a restart.

Serialize both operations end-to-end behind an operation lock, so
the in-memory queue is only advanced after its snapshot has been
persisted, and persistence writes are submitted in mutation order.

Add regression tests for failed-enqueue replay, failed-ack retries,
concurrent enqueue/ack under load, and restart behavior, using a
fault-injecting KVStore.

Fixes #1027.

Author: elnafateh