every place that queued or dropped a backfill wrote the `pending` keyspace directly. it's `pub(super)` now, like `records`: writes go through `stage_pending_insert` and `stage_pending_remove`, reads through `is_pending`, `pending_iter` and `pending_range`. both writes take the did already, since a did-ordered copy of the queue has to change in the same places. no behavior change.