Production hardening for unattended and side-effecting agentic runs

## Origin

Deferred from the MVP proposed as a fresh realization of #485.

## Goal

Harden the experimental vertical slice for unattended and externally consequential production runs.

## Scope

- Human clarification/approval, pause/resume, plan diffs, escalation, and accepted-risk UX.
- Policy for unattended runs and budget-exhaustion behavior.
- Side-effect classes, approval gates, idempotency keys, duplicate completion, and compensating actions.
- Exact/recorded-response/semantic replay levels for deterministic tools, APIs, and model calls.
- Cost reservations, quotas, storage/network budgets, and operator alerts.
- Plan evolution and migration of not-yet-started nodes while completed attempts remain pinned.
- SLOs, observability, audit export, backup, and disaster recovery.

## Acceptance criteria

- [ ] Destructive/external effects cannot occur outside delegated authority and approval policy.
- [ ] Crash/retry cannot silently duplicate a declared non-idempotent action.
- [ ] Operators can answer what is running, blocked, uncertain, over budget, or awaiting approval.
- [ ] Plan revisions are diffable and preserve complete lineage.
- [ ] Unattended-run defaults and recovery procedures are documented and tested.