fix: recover repair and exact-review workers

[hxy91819]

Root causes

• Blacksmith exposes mount_setattr(2) as ENOSYS; validation treated the missing optional syscall as containment failure even though per-mount read-only remounting is available.
• Exact-review lease claims treated expected conflict outcomes as fatal, then downstream reviewer/publisher steps consumed absent outputs.

Changes

• Fall back only on ENOSYS to /proc/self/mountinfo plus bind-remount-readonly; all other containment errors remain fail-closed.
• Classify only known lease-conflict reasons as clean skips, initialize safe outputs, guard every downstream claim-dependent step, and keep unknown 409/4xx/malformed responses fatal.
• Make identical claim retries replay the successful decision.

Validation

• corepack enable
• pnpm install
• pnpm run check
• focused repair/exact-review tests: 150 passed
• autoreview: 0 findings (confidence 0.86)

No live apply/close command was run and no workflow was disabled.