feat: add guarded agent triage recovery

[andrei-hasna]

Summary

• Add SDK, CLI, and MCP triage and recover agent-abstraction commands with versioned compact schemas.
• Triage classifies target state, captures bounded redacted excerpts, and can write full bounded redacted artifacts under the dispatch-owned artifacts directory.
• Recover defaults to dry-run and routes both dry-run and apply through existing guarded dispatch send semantics.
• Add capture char caps and truncation metadata, docs/help, and focused regressions for arbitrary node refusal, dry-run planning, artifact path constraints, symlink refusal, and long-line capture bounds.

Validation

• bun run typecheck
• bun test: 411 pass, 0 fail
• bun run build
• Focused: bun test src/lib/agent-recovery.test.ts src/cli/cli.test.ts src/mcp/tools.test.ts src/lib/capture.test.ts
• Live smoke on open-dispatch:1.1: dispatch.agentTriage.v1 ok/queue; dispatch.agentRecover.v1 planned dry-run with dispatch dry-run summary; invalid absolute artifact path refused; relative artifact stored under DISPATCH_DATA_DIR/artifacts/.

Review

Adversarial reviewer Boole found artifact path, synthetic dry-run, capture char-bound, and artifact symlink blockers. All were reconciled; final recheck reported no remaining blockers.

Task: 387b3ad0-260a-454d-a890-06d8bdb15890