[P1][CORE-04] Recovery and bounded replay

Parent: #1

## Objective
Make recovery deterministic after crashes, suspend/resume, network loss and partial external completion without ever replaying irreversible production actions blindly.

## Scope
- Durable checkpoints and task snapshots.
- Restart/resume policy per operation effect class.
- Fixture/captured-observation replay for debugging and regression.
- Handling expired auth, stale observations, partial provider sessions and missing artifacts.
- Explicit `NeedsReconciliation` path for ambiguous side effects.
- Recovery UX describing what resumed, what was cancelled and what remains uncertain.

## Design requirements
- Production replay must never resubmit purchases, bids, messages, deletions or other irreversible writes merely because the local process missed the response.
- Trace replay uses captured observations or resettable fixtures.
- Recovery revalidates deadlines, grants and freshness rather than assuming pre-crash authority remains valid.

## Acceptance criteria
- [ ] Captured traces replay without any live irreversible side effect.
- [ ] Unknown write outcomes enter reconciliation instead of automatic retry.
- [ ] Suspend/resume and restart recover supported read-only tasks from durable state.
- [ ] Expired grants/auth are surfaced and require the correct recovery path.
- [ ] Recovery after partial artifact persistence is deterministic and tested.
- [ ] User-facing task history clearly distinguishes resumed, failed, cancelled and uncertain operations.

## Dependencies
- CORE-02
- CORE-03

**First phase:** P1
**Maturity target:** P4
**Workstream:** Runtime and contracts

Begin by reviewing dependencies CORE-02 and CORE-03, then map the runtime and contracts workstream against the recovery scope and acceptance criteria. Done means deterministic recovery is tested for supported read-only tasks, ambiguous writes reconcile safely, expired authority is surfaced, and task history distinguishes each outcome.

Written by the indexing model from the issue text.