Implement E17-T2 recovery engine and resume replay backend

[dmoliveira]

Summary

• add recovery engine primitives for checkpoint discovery, eligibility evaluation, interruption-class cooldowns, and attempt-limit escalation
• integrate /start-work recover backend flow with approval-gated replay for non-idempotent steps and persisted resume audit trail events
• extend deterministic selftests and update roadmap/docs/changelog for Epic 17 Task 17.2 completion

Testing

• make validate
• make selftest
• make install-test