Add bounded generic-web deploy recovery helper

[cbusillo]

Summary

• add explicit generic-web deploy recovery dry-run and reviewed apply commands
• require private out-of-repo payload files and the original deploy idempotency key
• bind apply to a reviewed 64-character recovery digest
• project the service's direct bounded response models and fail closed on unknown fields
• block raw HTTP recovery calls through skill command policy
• document the operator boundary and recovery verification flow

Validation

• uv run launchplane/scripts/test_launchplane_helpers.py (30 tests)
• uv run skill-creator/scripts/quick_validate.py launchplane
• uv run skill-creator/scripts/validate-skill-behavior.py
• uv run skill-creator/scripts/validate-skill-repo.py
• git diff --check
• independent cross-repo review completed; all findings resolved

Companion service PR: cbusillo/launchplane#2171