fix: preserve failure diagnostics and recover historical admission layout

[MarcoPorcellato]

Summary

Fixes #63.

This PR closes two related fail-closed observability and recovery gaps:

• persists a bounded, redacted diagnostic sidecar for terminal journal failures whose coarse kind is unknown;
• adds an explicit, hash-bound admission layout-recovery status/apply flow for the single supported historical case: a CCP-owned, plain, empty agent-tickets/ directory.

The sidecar is strict, owned, and bound to the exact terminal failed + unknown entry. The layout recovery keeps normal admission strict, requires a separately authorized exact plan digest, rebuilds the plan under queue-then-slot locks, and preserves the empty directory through a rename-only move into deterministic quarantine.

Trust claim checklist

• No claim of native or live-host qualification is made.
• layout-recovery status is read-only and authorizes neither apply nor a later heavy run.
• layout-recovery apply authorizes only one exact hash-bound recovery; it does not authorize CCP run, Docker, publication, or R5.
• Manual deletion, movement, quarantine, or reinterpretation of admission state remains unsupported.
• not_applied and recovery_uncertain remain non-success outcomes; uncertainty is never promoted to success.

Impact and rollback

• Runtime/trust boundary: adds a strict enum-only journal diagnostic sidecar and an explicit admission-layout recovery command. Normal admission continues to reject agent-tickets/ until a separately authorized recovery completes.
• Concurrency/durability: recovery acquires existing queue then slot locks, releases slot then queue, revalidates under lock, uses rename only, synchronizes both parents, never overwrites/deletes, and has no EXDEV copy/delete fallback.
• Privacy: no raw error text, absolute path, environment, command, repository, user, ticket/lease content, or secret is emitted by the new schemas.
• Dependency/supply chain: no dependency changes.
• Rollback: revert these commits before any live use. A future separately authorized live recovery is an append-once state transition and is not implicitly undone by reverting source.

Validation

Validated exact head: 742ac544ebaedfcc656b683424d9045da30a2b32.

• cargo fmt --all -- --check — PASS.
• RUSTFLAGS=-Dwarnings cargo check --locked --all-targets — PASS.
• focused layout recovery — 18 passed.
• focused durable filesystem — 9 passed.
• focused recovery CLI — 3 passed.
• agent integration contract — 2 passed.
• cargo test --locked — 357 passed, 3 ignored/NOT_RUN.
• git diff --check — PASS.
• Cargo.toml / Cargo.lock diff — empty.

Explicitly not run

• live admission layout-recovery status or apply against the platform coordinator;
• candidate build or candidate SHA-256 qualification;
• CCP run, Docker, network workload, receipt publication, or R5 qualification;
• native/heavy ignored tests.

A future live apply must be separately authorized against the exact source commit, absolute candidate path, candidate SHA-256, and recovery plan SHA-256. Any later receipt run requires another exact-head authorization.

[MarcoPorcellato]

CI status for exact head 742ac544ebaedfcc656b683424d9045da30a2b32 is intentionally still blocked on commit-bound evidence.

The workflow successfully checked out trusted base 866db18a571f55ed3d9b481d6c9c9c3bd5e98d55, then failed only while fetching the absent branch/tag ccp-evidence/742ac544ebaedfcc656b683424d9045da30a2b32. Consequently EVIDENCE_OUTCOME=failure; trusted verifier build and verification were skipped.

This is consistent with the explicit NOT-RUN boundary in the PR description: no live admission recovery, candidate build, CCP run, or evidence publication has been authorized for this head. No retry or synthetic status override was performed.

Next safe gate is a separate exact-hash authorization binding:

• source commit 742ac544ebaedfcc656b683424d9045da30a2b32;
• absolute candidate binary path and its SHA-256;
• exact layout-recovery status plan SHA-256 and one apply authorization, if recovery is still required;
• a separate authorization for the later receipt-producing CCP run and evidence publication.