Recover unknown Autopilot executions safely

[drafael]

Summary

• add fenced operator recovery for unknown executions: abandon, adopt an exact tree, or stop
• permanently quarantine uncertain worktrees and prevent late results from restoring authority
• re-enter ordinary verification for adopted trees without launching implementation work
• surface recovery state through reports, CLI help, and recovery documentation

Safety properties

• binds recovery to the current run lock, item, attempt, and lease epoch
• requires explicit operator attestation
• rejects stale controls and changed adopted identities
• preserves unauthorized suspect changes during quarantine
• keeps lifecycle state canonical in events.jsonl

Validation

• npm run typecheck
• npm run lint
• npm run format:check
• npm test — 195 tests: 187 passed, 8 platform skips, 0 failed
• git diff --check
• independent review: no issues found