History purge goes through the storage backend, with a hard refusal when it cannot

Counting and rewriting history.jsonl for a purge now prefer the storage interface, a paged scan followed by replaceRecords, falling back to the old readline-based path only when the backend defers. Some conditions now raise a fatal error saying the file was not rewritten instead of failing silently: a symlinked or non-regular history file, or a declined read or rewrite. Purge failure telemetry also became per-code, reporting multiple_failures when several codes appear, instead of a single blanket config_write_failed.