Add restart, recovery, and source reconciliation #3

Context

Amnion PR #2 is a foreground local process with deterministic replay but does not yet restore selection or reconcile live Pincher and Decapod sources after restart.

Scope

Implement restart/recovery behavior that:

• restores ephemeral UI selection/detail/verbosity separately from governance state;
• replays Pincher events from a known cursor or replay boundary;
• queries Decapod authority after restart;
• marks stale, unavailable, and incomplete sources explicitly;
• reconciles duplicate, out-of-order, late, and contradictory evidence deterministically;
• never fabricates progress when a source is absent;
• remains daemonless and shuts down cleanly.

Any UI preference persistence must be clearly separated from governance truth and bounded in scope.

Non-goals

No Amnion governance database, hidden background daemon, optimistic recovery, automatic approval/proof, or provider process recovery owned by Amnion.

Acceptance criteria

1. Restart tests produce the same projection for the same event/evidence set.
2. Selection restoration cannot change intent governance status.
3. Replay cursor/resume and duplicate handling are explicit and tested.
4. Decapod authority is rechecked before displaying an action-safe ready/promoted state.
5. Stale and unavailable markers survive restart and recovery failure.
6. Contradictory evidence is surfaced, never silently resolved.
7. No background process remains after quit.

Dependencies

Real Pincher adapter, authoritative Decapod enrichment, and PR #2 deterministic reducer.

Validation expectations

Run restart/replay/reconciliation integration tests, bounded-memory/backpressure checks, cargo fmt/test/Clippy, and Decapod validation/proof checks.

Related: #2