seller: audited manual recovery for unresolved publication

[Community-AI-tools]

Recovery safety

Fixes the seller publication state where a prior postSellOffer outcome is unresolved, exact current reads prove no resting SELL and no buyer-owned contract, but the retained marker correctly blocks an automatic retry.

• retains write-ahead marker and reconciles it against exact owner-scoped book, TokenContract latch and event/outcome reads;
• never turns a timer/service restart into a repost;
• exposes recovery only through explicit --recover-publication plus confirmation;
• requires one immutable, hash-bound audit before a one-shot permit can be consumed;
• refuses missing/tampered audit, positive/unreadable evidence, duplicate recovery and contract mismatch;
• binds accepted alternate address spelling to the exact selected runtime TokenContract.

No inactivity close, marker deletion, force restart, wallet/Note or automatic chain recovery path is added.

Closes #161.

Local diff check is clean. Full Rust test/build is delegated to GitHub CI because this workstation is above the configured RAM ceiling for builds.