Add digest-bound generic-web deploy recovery apply

[cbusillo]

Summary

• add reviewed apply for existing-only generic-web deploy recovery
• recompute the Stage 1 inspection and require an exact recovery digest
• CAS-transition expired running reservations through existing reconciliation state
• reuse exact-match adopt/retry machinery without reserve, release, or supersession
• resume only already-acquired reservations and preserve reconcile-required state on uncertainty
• preserve original deploy evidence while adding bounded recovery metadata for lost-response replay

Safety

• never creates, releases, replaces, or supersedes a deploy reservation
• never repeats an unknown provider effect
• reauthorizes against the stored operation context
• rejects reservation, target, provider observation, or digest drift
• returns only bounded/redacted recovery evidence

Validation

• focused provider/recovery/route tests: 55 passed
• official local shard gate: 2,943 targets, 12/12 shards passed
• scoped Ruff, format, and mypy passed
• OpenAPI generation/drift and git diff --check passed
• independent cross-repo review completed; all findings resolved
• PyCharm exact-worktree inspection remained UNKNOWN/stale_results after its internal retry, with no current findings available

Refs #2167