wallet: fix sweep-scheduler wedge and unsynchronized driver mutation

The zaddr-sweep op cleared fSweepRunning/nextSweep only on the sweepComplete
success path (inside main_impl), so a cancelled or throwing sweep left
fSweepRunning stuck true. Since fSweepRunning now also gates consolidation and
the default-on autoshield, a persistently failing sweep (e.g. a corrupt-witness
note) would wedge all three background ops for the session.

Move the scheduler bookkeeping into main() so it runs on every terminal state
(success/failure/exception/cancel), guarded by op id. Preserve the intended
"keep draining every block until swept" model: on a successful-but-incomplete
round the flag stays set and nextSweep is not advanced; on completion OR on
failure/exception the flag is released and nextSweep backs off one interval, so
a failing sweep no longer retries every block or wedges the other ops.

Also fix RunSaplingSweep to take cs_wallet itself (was AssertLockHeld, a no-op
in release builds) since ChainTip does not hold it there and the driver mutates
scheduler state + enqueues -- matching RunSaplingConsolidation and
RunAutoShieldCoinbase.

sweepComplete is recorded via a new member; saplingSweepOperationId made public.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/wallet/wallet.cpp

@@ -585,7 +585,13 @@ void CWallet::RunSaplingSweep(int blockHeight) {
     if (blockHeight == 0)
 	return;
 
-    AssertLockHeld(cs_wallet);
+    // Take cs_wallet ourselves: ChainTip (the notify-thread caller) does NOT
+    // hold it here, and we mutate fSweepRunning/nextSweep/saplingSweepOperationId
+    // and enqueue below. Matches RunSaplingConsolidation/RunAutoShieldCoinbase.
+    // (The old AssertLockHeld(cs_wallet) was a no-op in release builds and thus
+    // masked an unsynchronized mutation.) cs_wallet is recursive, so this is
+    // safe even on any path that already holds it.
+    LOCK(cs_wallet);
     if (!fSweepEnabled) {
         return;
     }