[Ehsan-hash]

Fixes #389.

A resumed run could report completion after a truncated model response if its tool permissions had been reduced to finish only. Recovery now stays pending and pauses for a usable continuation permission. Saved actions, debug edits, and accepted action edits cannot substitute finish for that continuation. Recovery clears after an authorized non-finish action produces its result, with its accounting retained.

Validation:

• Reproduced the premature completion through the actual runtime on the original source; the same scenario now pauses without a second model request.
• 8 focused checks passed, including persisted restart/repeated pause, restored file reading, durable action-review edits, saved finish actions, debug edits, ordinary completion, and usage accounting.
• 21 affected output-budget, recovery, lifecycle, and SQLite accounting checks passed. Substituting the original runtime and recovery helper makes four new regression scenarios fail while the ordinary control passes.

The runtime scenarios use isolated SQLite/data/workspaces and httpx.MockTransport at the HTTP boundary. No live model or scientific validation was performed. One existing Bubblewrap-dependent read test fails because bwrap is unavailable on this Mac. Real-process scenarios, two localhost-server checks, browser checks, and the full suite were not run.