Route recovery dry runs through reusable workflow identity

[cbusillo]

Summary

• recognize inherited caller workflow_dispatch recovery inputs in the reusable stable-deploy workflow
• construct the bounded recovery envelope inside the authorized reusable job
• skip stable deploy whenever manual recovery mode is active

Validation

• actionlint
• focused recovery action tests: 8 passed
• config-authority audit
• Ruff check and format check
• PyCharm changed-files inspection: zero findings
• uv run --extra dev launchplane ci unittest-shard local: 2,944 targets across 12 shards passed

Safety

• dry-run only; no apply input or route is added
• the bounded recovery action remains pinned to b2055d2944626234664390d6fcd96975ded38511
• ordinary stable deploy behavior is unchanged outside recovery dispatches

Related to #2167