Complete release-recovery rollout and decide the opt-in lifecycle #603

🤖 Generated by the Agentic Engineer

Problem

The default-off recovery path in #602 needs protected consumer proof before its adoption or flag lifecycle is decided. Offline HTTP controls do not demonstrate real App draft visibility, historical release authorization or completed publication.

Acceptance criteria

• After Recover a missing stable GitHub publication without replaying release side effects #602 merges and releases, select a protected consumer recovery under Recover GitHub releases after a tag-only partial publication #587 with exact catalogue provenance, repository-scoped credentials and the normal release queue.
• Record actual App capability/draft inventory, original run/tag/source and final publication readback, plus an explicit rerun producing no additional write.
• Preserve source tags, semantic-release stable-channel behavior and latest-release selection. Fail or keep unsupported cases open; never expand token permissions silently.
• Decide the enable-recovery input lifecycle from that evidence: remove a temporary rollout flag in a separate reviewed PR, or document why it remains a permanent explicit operator gate. Keep disabled/enabled credential boundaries tested.
• This issue stays open until protected rollout is observed; merging fixture coverage alone does not close it.

Priority: High; Effort: Medium including provider evidence and review. Service class: Risk reduction.

Part of #587