Self-repair: re-observation bridge when the proposed control is a different kind #2119

From the closed draft #1449, which was never tested end to end. In replace mode, when the proposed repair control isn't the halted step's kind (for example a menu instead of the save), self-repair could click it on the live halted screen as a bridge step and ask again, within a small action budget (3). Neither main nor #1902 has this.

It changes repair admission, so it needs a design decision before any code:

• what may be clicked as a bridge (read-only controls only, under the write fence);
• the action budget;
• how the bridge steps are recorded and checked.

#1449's version (_LookAgain, _SoFar, RepairRequest.bridge_so_far, _KindMismatch) stays on branch repair/reobserve-bridge for reference. Main's self_repair.py has changed about 970 lines since then, so a new PR on current main with headless tests is the way to do it.

Its learned 'Continue'/'OK' dismissals are not carried forward, because #1902 deliberately refuses those labels as dismissals (fail closed).