Add a configurable retry limit to the while (true) loop in _recoverCollectionMetadataFromDisk. The three continue sites (joining a concurrent critical section/refresh, a failed initial pass, and an invalidating oplog entry during drain) should all count toward the cap.

Once exhausted, fail with a clear error that propagates to router or shard role loop, which can retry at a higher level. Log at higher severity when approaching or exceeding the limit.