Add existing-only generic-web deploy recovery dry run

[cbusillo]

Summary

• add a read-only, existing-reservation-only generic-web deploy recovery endpoint
• bind inspection to the original deploy route payload fingerprint and stored operation identity
• reauthorize against both the current lane and stored operation context
• return only bounded/redacted hashes, observation state, and proposed action
• document the operator boundary and generate the OpenAPI contract

Safety

• never reserves, releases, retries, adopts, supersedes, or writes
• rejects missing, ambiguous, changed, malformed, unauthorized, or fingerprint-mismatched reservations
• treats provider uncertainty as hold_unknown
• Stage 2 apply remains separate and requires reviewed digest evidence plus explicit production approval

Validation

• uv run --extra dev python -m unittest tests.test_generic_web_deploy_recovery tests.test_http_write_route_registrars tests.test_generic_web_deploy tests.test_postgres_store (223 tests)
• scoped Ruff, Ruff format, and mypy
• OpenAPI export/generation/drift checks
• exact tree: uv run --extra dev launchplane ci unittest-shard local (2,920 targets)
• independent endpoint review: LOVE

Stacked on #2169.
Refs #2167