Consume staged recovery requests in reusable workflow

[cbusillo]

Summary

• recognize the established Launchplane Recovery Request workflow-run event in the authorized reusable deploy workflow
• download only the triggering run's staged request artifact
• enforce exact source identity plus single-file and size bounds before the existing bounded dry-run action

Validation

• actionlint
• focused recovery action tests: 5 passed
• config-authority audit: passed
• Ruff dry-run, lint, and format check: passed
• PyCharm changed-files inspection: zero findings
• uv run --extra dev launchplane ci unittest-shard local: 2,944 targets across 12 shards passed
• git diff --check

Safety

• no authorization rule changes
• no apply input or route
• artifact mode requires the exact workflow name/path, successful manual event, main branch, and same repository
• artifact consumption is tied to the triggering run ID and bounded to one file under 32 KiB

Related to #2167