[ADC-753] Enforce model-declared recovery admissibility

[wolf75222]

What changed

• adds the optional C++ HasRecoveryAdmissibility model contract and forwards it through CompositeModel
• makes prepare_model_variable_recovery install that declared predicate in the executable recovery plan
• adds public Python authoring via Model.recovery_admissibility(rho=rho > 0, p=p > 0)
• emits device-callable primitive predicates, component-qualified failures, and includes policy semantics in the compiled model hash
• preserves the historical finite-only path for models that declare no policy

Why

The existing ADC-753 foundation rejected non-finite candidates transactionally, but a finite primitive state could still violate model physics. The Python model had no route to put density, pressure, realizability, or similar constraints into the native prepared recovery chain. This slice closes that concrete authoring-to-execution gap without introducing callbacks or a second recovery engine.

Functional proof in this slice

• a generated model emits its declared primitive predicate
• the public board Model is the authoring authority
• the composite native model exposes the optional contract
• an inadmissible finite candidate yields kInadmissibleCandidate, retains the failing primitive component, and cannot be published
• an admissible candidate still uses the closed-form fast path
• an undeclared policy emits no method and keeps the previous finite-only plan

Validation performed

Source-only validation, intentionally without a native build:

• 35 targeted Python tests passed
• Ruff passed on all changed Python files
• clang-format dry-run passed on all changed C++ files
• packaging manifest check passed
• docs check passed (one pre-existing/staleness warning only)
• git diff --check passed

The native test_variable_recovery_chain case was added but was not compiled or executed in this lot per the no-build instruction.

Deliberately not claimed

This does not close ADC-753. It does not add iterative recovery methods, declared repair publication, persistent patch/device workspaces, warm-start persistence across regrid/migration/restart, species-qualified multi-state policies, GPU/MPI evidence, benchmarks, or full consumer/no-bypass proof.

Stacked on the P2 consolidation branch because the transactional recovery chain from PR #609 is not yet on master.

Linear: ADC-753