fix(server): recovery-only write restrictions for Kimi fallback runs

[om952]

• Paperclip orchestrates AI agents for zero-human companies
• The Levi control plane must stay autonomous even when expensive models are unavailable
• One failure mode is agents falling back to cheap/recovery models (e.g., Kimi) and still writing deliverables
• Writing deliverables from a degraded model can produce low-quality outputs and break trust in autonomous operation
• This PR marks fallback runs as recovery-only and blocks deliverable writes unless explicitly allowed
• The result is safer autonomous behavior when the primary model is unavailable
• The benefit is zero-human control planes can self-heal without degrading issue state

What Changed

• Add recovery_only column to heartbeat_runs with migration 0094.
• Mark runs as recovery-only when a cheap/status-only model profile is used or when the Kimi fallback is triggered.
• Add adapterConfig.fallback.allowDeliverables override to keep deliverable writes enabled when intended.
• Add recoveryOnlyGuard middleware that rejects deliverable writes for recovery-only runs.
• Apply the guard to deliverable-mutating issue routes: issue edits, documents, annotations, comments, work products, approval links, and issue create/reparent/move.
• Add regression tests in server/src/__tests__/recovery-only-write-restrictions.test.ts and register them in the serialized test runner.

Verification

• pnpm -r typecheck passes across all workspace packages.
• pnpm exec vitest run --project @paperclipai/server server/src/__tests__/recovery-only-write-restrictions.test.ts passes (5/5).
• node scripts/run-vitest-stable.mjs --mode serialized --shard-index 81 --shard-count 91 runs the new suite through the official CI runner and passes.

Closes #31