fix: relay uncommitted fulfills upstream after on-chain settlement

[jjyr]

When a router force-closes its downstream channel and receives a peer fulfill before the close confirms, the TLC becomes RemoteRemoved without completing its removal handshake. On-chain reconciliation previously treated the existing removal reason as completion, skipping the upstream fulfill and potentially finalizing the channel while the payer remained inflight.

Keep these unconfirmed forwarded fulfills eligible for recovery using the existing channel-scoped on-chain preimage evidence. Both live-actor and offline relay completion paths now persist AppliedFlags::REMOVE only after upstream delivery is accepted or durably queued. This distinguishes receiving the downstream fulfill from completing its upstream side effects, preserving retries until delivery and preventing subsequent recollection. No persisted fields are added, and the on-chain failure selection rules are unchanged.

Validation:

• Confirmed the collector, live-actor, and offline regressions failed before the fix.
• All 67 related reconciliation/payment tests pass, including existing timeout/exclusion failures, unavailable-upstream recovery, restart after durable upstream queueing, and three-node payment success. The three-node regression injects the state left by the close/fulfill race rather than relying on mock-chain timing.
• make clippy passes, including native all-features, SQLite without default features, and WASM checks.
• cargo fmt --all -- --check and git diff --check pass.

Fixes #1660.

[gpBlockchain]

lgtm