Route deploy recovery through authorized reusable identity

[cbusillo]

Summary

• add an optional dry-run-only recovery request to the existing generic-web stable-deploy reusable workflow
• skip stable deploy whenever the recovery request is present
• execute the bounded recovery action under the already-authorized reusable workflow identity
• allow the private connector envelope to carry launchplane_url, stripping it before the service payload

Why

Two read-only dispatches proved the caller workflow path alone is not sufficient for Launchplane authz:

• launchplane_req_57ec813d76434e6195d53b93848ce44c
• launchplane_req_d45aac5be8e348b2943d13f942cc2acb

The existing stable-deploy reusable workflow identity is authorized and reached Launchplane with 409 mutation_in_progress. This change reuses that exact identity without changing authz policy.

Safety

• non-empty recovery_request_json skips the stable-deploy job
• recovery path calls only /v1/admin/generic-web/deploy-recovery/dry-run
• no apply input, route, or expected digest exists
• connector URL is removed before payload submission
• bounded response fields only

Validation

• actionlint .github/workflows/reusable-generic-web-stable-deploy.yml
• focused action/workflow/supply-chain tests
• full local suite: 2,944 targets, 12/12 shards
• config-authority changed-files gate
• scoped Ruff and format checks
• node --check
• PyCharm changed-files inspection: zero findings
• git diff --check

Related: #2167