Story: CLI 'consensus node upgrade-recover [--plan]' command (HIP step 3j)

Part of the consensus-node upgrade-lifecycle CLI commands. Implements the operator recovery command referenced by HIP XXXX2 self-upgrade **step 3j** and the failure-handling table (HIP lines 1969, 1973), as described in the implementation guide / network-upgrade mindmap.

> **Command surface (current):** `solo-provisioner consensus node upgrade-recover`, part of the unified `consensus node` command set. The earlier `network upgrade recover` name is dropped (see consensus-node-command-surface memory).

## Context

When an infrastructure upgrade or self-upgrade fails and automatic recovery (#528) also fails, the node may be left with no daemon running and/or a partially torn-down cluster. This command assesses and stabilises the host, then lets the daemon resume. It is the **mutating** half of the diagnose→recover pair (#718 is the read-only advisor).

## Plan producer/consumer relationship (mirrors `migrate`)

Like `consensus node migrate --plan `, recovery supports an **optional reviewed plan**:

- **No `--plan` (default):** run the standard repair — restore binaries from `.bak`, `systemctl start solo-provisioner`, daemon re-reads the Execute CR and resumes. An operator who just wants the standard repair is not forced to run `upgrade-diagnose` first.
- **`--plan `:** execute the reviewed recovery plan produced by `upgrade-diagnose` (#718), idempotently. The plan describes the proposed actions (which binaries to restore from which `.bak`, whether to restart, expected resume phase, etc.) and may be edited by the operator before execution.

## Scope

- New CLI command `solo-provisioner consensus node upgrade-recover [--plan ]`.
- Inspect `self-upgrade.yaml` (HIP-authoritative path `/opt/solo/weaver/daemon/self-upgrade.yaml`) and other diagnostic artifacts.
- Restore binaries from `solo-provisioner-.bak` / `solo-provisioner-daemon-.bak` if needed, then `systemctl start solo-provisioner`.
- After restart the daemon re-reads the Execute CR status (**`PendingInfraUpgrade`**, the durable resume point preserved in etcd) and retries the infra upgrade — recover does not itself drive the CR to terminal.
- Idempotent; safe to re-run.
- Document the new command + flags (including `--plan`) in `docs/quickstart.md`.

## Acceptance criteria

- With no flag, performs the default restore-and-restart sequence.
- With `--plan`, executes the reviewed plan's actions idempotently.
- Reads and surfaces `self-upgrade.yaml` state to the operator.
- After restart, daemon resumes from preserved CR status `PendingInfraUpgrade` (no manual CR edits required).
- Idempotent / safe to re-run.

## Dependencies

- `self-upgrade.yaml` schema (#529), `.bak` naming (#526).
- Execute-phase resume from `PendingInfraUpgrade` (#709).
- Consumes the recovery plan produced by `upgrade-diagnose` (#718).