feat: recover or reset blocked run-once runs

[rochecompaan]

Summary

• resume explicitly retried blocked issue runs when saved workspace evidence is safe
• add guarded reset, lease repair, archival, quarantine, and compare-and-swap Git mutation flows
• preserve valid checkpoints and effect receipts while preventing duplicate lifecycle comments
• distinguish empty stale branches from completed issue work
• document the recovery commands and add adversarial real-Git coverage

Validation

• npm run test:run-once — 565 tests passed
• npm test — 1494 tests passed
• npm run lint — passed with zero errors
• npm run build — passed
• CLI help smoke tests for run, run reset, and run lease repair — passed
• git diff --check — passed

npm run check:architecture reports the existing baseline extensions/todos.ts → typebox unresolvable-dependency violation. The branch does not change that source, dependency configuration, or dependency manifests.

Review gates

• final Codex full-worktree review: passed
• final thermo-nuclear review: passed
• final validation-readiness review: passed at c4b46d48b93e85f40e5acc134389bc5172a8de57

Landing decision

PR required: this is a large, safety-sensitive recovery and reset refactor with new CLI behavior and guarded Git/filesystem mutation. It needs human review rather than direct landing.

Closes #183