Guard recovery attempts and prepare durable execution registration

[DavidBakerEffendi]

The lost execution roots made local attempt limits insufficient: registering another root could start the same operation at attempt 01 again. This change adds prospective recovery launch guards and records a disabled final launch packet without rewriting historical evidence.

Key Changes:

• Bind cumulative attempt history and an explicitly reviewed recovery allocation to a durable release-wide claim ledger; persist claims before dispatch and block missing/corrupt ledgers or unresolved history.
• Add a versioned OpenTaint product probe using explicit hash-bound restoration and runtime references, preserving the historical probe bytes.
• Register all 117 prospective command identities, exact runtime readback, runner build prerequisites, serial launch sequence, and resource/monitoring bounds. Preserve unknown history and the 102960-second ceiling; no benchmark execution is authorized by this PR.

Touch Points:

• Prospective recovery launchers and claim-ledger helpers/tests under scripts/
• Versioned OpenTaint recovery probe and tests
• reports/releases/v0.9.0/execution-v1/final-recovery-20260930-01/
• recovery/2026-09-30-execution-loss/ audit reports
• Parser coverage and .github/workflows/ci.yml

The packet remains disabled pending merged harness/runner identity, new Swift query qualification, full exact-root runtime preflight, parent review of the explicit infrastructure-loss allocation, and a fresh exclusive resource reservation. Bifrost's active coverage exporter has priority. No analyzer diagnostic or benchmark was run during preparation.

Validation: 12 recovery resource-gate regressions (including the observed Bifrost Python exporter), 11 claim/launcher regressions, seven relocated OpenTaint regressions, the original six OpenTaint tests, existing launcher/supervisor tests, both packets shell/Python parser checks, canonical planning checks, cargo formatting and diff checks pass locally. Hosted CI tests the final 93 Rust argv and full repository gates; local Cargo is deferred for active Bifrost coverage work.