feat: 불확정 모델 호출의 명시적 오프라인 복구

[SonAIengine]

Summary

Expose the existing AgentLoop::abandon_model_call safely through an offline public CLI command. No Core, protocol, SQLite schema, dependency, default resume, or possible-send budget changes.

xgeny recover RUN_ID
xgeny recover RUN_ID --discard-model-call EXACT_CALL_ID

• Inspection emits a bounded JSON view of the verified active call, journal head and original lifecycle counters without appending events.
• Explicit discard verifies the exact active ID under the Run lease and existing read-only/integrity/CAS boundaries, then appends one Abandoned/RecoveryDiscarded settlement using Core.
• No provider or tool execution, credential resolution, budget refund, completion claim, implicit retry or automatic resume. Wrong/stale/repeated IDs and live-owner/corrupt-state cases fail closed.
• Separate resume retains the original workspace identity, catalogs, profile, permissions, effects and remaining budget. Unknown effects remain blocked.
• ADR-0040 and the recovery guide describe host integration and acknowledgement-loss boundaries. ADR-0039 is reserved by the separate output-truncation PR planner 출력 잘림을 provider_limit과 구분해 output_truncated로 기록 #64.

Verification

• TDD baseline failed with unrecognized recover; implemented public CLI suite: 10 passed (four new recovery tests).
• Full cargo test --workspace --locked: PASS using an isolated tmpfs test directory and fixed debug binary.
• cargo fmt --all -- --check: PASS.
• cargo clippy --workspace --all-targets -- -D warnings: PASS.
• cargo run --locked --quiet -p xgeny-cli -- protocol check: PASS (9 schemas, 28 fixtures, 26 semantic checks).
• cargo build --workspace --release --locked: PASS (Rust 1.98.0, Linux x86_64).
• RC3 public-docs, release-publisher and npm-release workflow checks: PASS.
• Optimized binary on an isolated copy of a pre-existing Interrupted Run: one settlement appended; reservations 2→2, settled 1→2, original maximum 16 unchanged; duplicate discard 64; no-egress resume 10. Original DB/WAL/project hashes unchanged.

One earlier full-suite attempt overlapped a debug rebuild and failed the executable-material integrity test; the final fixed-binary run passed it unchanged. No guard or timeout was weakened.

Limits / rollout

No live model call, ML training, production rollout or actual failed-project continuation in this PR. macOS/Windows and remote PR CI remain separate gates. Discard does not prove provider non-delivery/non-billing. External harnesses must retain the original workspace and record scoped recovery authority before integrating this command; it must not become an unconditional timeout retry handler.