Recover every authenticated turn after planned restarts

[hamzamerzic]

Summary

• bind each exact live turn to the planned restart before provider shutdown begins
• stop providers concurrently and preserve safe automatic recovery when a stop times out or the final transcript save fails
• use one captured boot authorization for startup reconciliation and the first continuation sweep
• keep the calm restart pause authoritative across provider teardown and log every reason a turn remains manual

Why

The existing authenticated restart design only recorded a turn after its provider had stopped and its final transcript had saved successfully. With several live turns, the old serial two-second stop window timed out ordinary provider teardown, while one invalid legacy transcript value could prevent another exact run from being parked. Those turns were then indistinguishable from generic crash recovery and remained manual after boot.

This extends the authenticated design from #157 and the nonce-only supervisor boundary from #162. It also preserves the safety requirement documented in #153: a database nonce never authorizes continuation by itself. The same nonce must still match the root-owned acknowledgement for this exact boot, the latest exact run, the chat policy, ownership, queued-work attribution, and question state.

Safety

• a crash before supervisor acknowledgement still falls back to manual recovery
• a missing or mismatched acknowledgement, policy-off chat, unanswered question, app-owned run, app-queued work, or superseded run still cannot continue automatically
• startup finalizes the persisted partial transcript before converting an authenticated running row into a due restart continuation
• provider-limit continuation keeps its existing stagger; only the exact set already live before a planned restart may resume together

Validation

• 225 focused restart, continuation, lifecycle, writer, crash-recovery, terminal-completion, and provider-contract tests passed
• Python compilation and whitespace checks passed
• the production five-turn failure shape is covered: one clean stop, three stop timeouts, and one terminal-save failure all reach the immediate authorized continuation sweep

[hamzamerzic]

Merged to main as part of #304. Planned-restart recovery is now included in the integrated default-branch change.