fix(runtime): recover unchanged verifier-blocked candidates

[davidahmann]

A missing verifier image could strand a committed candidate even after the image was restored. A rejected verification retry then replaced the original blocker.

Add an attended, exact-plan recovery that grants one fixed verification/review window for the unchanged candidate. Preserve the original deadline, attempts, authority and failure history; reject failed tests, drift, unresolved ownership, another recovery or any builder/repair. Every recovery requires original-deadline expiry and an immutable candidate version pin. Cross-version recovery binds the new controller. Read-only admission validates authority before writable state access or resource reconciliation. Rejected follow-up commands retain the original blocker.

Include recovery instructions, 0.8.1 source release notes and installed-package regression coverage. Publication remains a separate qualified release operation.

Validation: full npm run check passes, including 566 tests across 54 files, coverage thresholds and installed-package recovery/review/delivery canaries. The clean exact-commit structural audit passes all nine categories. Integration tests use four workers to bound Git/Node subprocess fan-out; assertions and 10-second test deadlines are unchanged. Independent architecture review found no P0/P1 after the admission redesign.

Local exact-candidate Codex review: 26e93ee15bf746be6b2c3ee9d539404282045b3e, zero findings. Receipt mill-0.8.1-26e93ee.json was checked against the unchanged candidate immediately before push. This is local maintainer evidence, not an admitted product-run or authenticated CI attestation.