Make intent replay self-healing

[KristjanPikhof]

Feature Description

Make ACD intent replay self-healing so stale branch chains no longer block
background commits or require destructive manual cleanup. Captured work is
either proven as already published or preserved under a hidden recovery ref
before its queue state changes.

This also adds bounded planner-outage fallback, simpler everyday lifecycle
controls, and the observability needed to distinguish waiting, healing,
degraded, and needs-attention states.

User Story

As a developer who leaves ACD running in the background, I want replay and
branch transitions to recover safely on their own so that commits keep flowing
without losing captured work.

Type of Change

• New feature

Implementation Details

• Reconcile complete unpublished (branch_ref, generation) chains instead of
  deleting or retargeting individual barriers.
• Prove exact final state as published; otherwise build an immutable recovery
  commit/ref before atomically marking the chain recovered.
• Preserve work across branch switches, rewinds, fast-forwards, deleted refs,
  acd fix, and commit-all without changing the live worktree or index.
• Persist planner circuit health, reuse one provider, and fall back to
  deterministic planning during bounded outage cooldowns.
• Add read-only bare health plus idempotent acd on / acd off controls and
  expose recovery/circuit details through status and diagnose output.

Architecture

The state layer owns immutable capture provenance, recovery snapshots, and
atomic lifecycle transitions. The daemon owns Git proof/archive construction,
branch-transition reconciliation, and planner circuit behavior. CLI commands
delegate to the same exact-chain reconciler, while docs and harness templates
describe the shipped lifecycle and recovery contracts.

These pieces form one rollback unit: the schema, reconciler, transition paths,
controls, integration proof, and documentation need to ship together.

Key Files Changed

File	Change
internal/state/recovery.go	Load immutable chains and atomically record published/recovered snapshots
internal/daemon/reconcile.go	Prove or archive complete chains without mutating live Git state
internal/daemon/intent_health.go	Persist circuit state and bound planner outages
internal/daemon/daemon.go	Reconcile transitions and reuse the planner/provider lifecycle
internal/cli/control.go	Add bare health plus idempotent acd on and acd off
internal/cli/fix.go	Route safe and forced repair through exact-chain recovery
test/integration/squash_backlog_recovery_test.go	Prove 60-capture squash/deleted-branch recovery

API Changes

No HTTP API changes.

Method	Endpoint	Description
CLI	acd	Read-only health summary and next action
CLI	acd on / acd off	Idempotent repo lifecycle controls
CLI/JSON	status / diagnose	Recovery snapshots, active barriers, and planner-circuit observability

Database Changes

• No database changes
• Migration included and tested

Schema v12 adds immutable recovery snapshots and ordered event membership.
Schema v13 adds the covering index used to retain published materialization
prefixes efficiently while an unresolved same-base suffix exists. Existing
databases migrate through the idempotent schema bootstrap.

How to Test

1. Run cleanenv make lint and cleanenv make test.
2. Run cleanenv go test ./test/integration/... -tags=integration -race -count=1 -timeout 5m.
3. Run cleanenv go test ./internal/daemon/... ./internal/git/... ./internal/state/... ./internal/pause/... ./internal/cli/... -race -count=3 -timeout 10m.
4. Inspect acd status --repo . and verify the daemon is healthy with no pending, blocked, failed, or capture-error rows.

The full implementation gate passed before the final documentation/help-only
commits. On the final branch head, cleanenv make lint and focused
Status|Diagnose|Help CLI race tests also pass.

Edge Cases Considered

• Squash/rebase recovery, deleted branches, same-SHA rewinds, fast-forwards,
  detached/missing refs, and linked worktrees.
• Missing objects, partial final-state matches, recovery-ref collisions, Git
  CAS races, SQLite rollback, and restart idempotency.
• Create, modify, delete, rename, mode, symlink, pathspec-magic, and whitespace
  filenames without touching user staging.
• Provider transport failures, invalid plans, cancellation races, half-open
  probes, repeated fallback windows, and secret-safe persisted errors.

Checklist

• Code follows the project's style guidelines
• Self-reviewed the code
• Added unit tests for new functionality
• Added integration tests where applicable
• Existing tests pass locally
• Updated documentation
• Tested on mobile (not applicable; CLI/daemon only)
• No new warnings or console errors introduced
• Backwards compatible (migration plan documented)

Feature Flag

• No feature flag needed
• Behind feature flag: FLAG_NAME

Intent behavior remains selected through the existing
ACD_COMMIT_STRATEGY=intent configuration.

Related Issues

None linked in the branch name or commit history.

Screenshots / Demo

Not applicable; this is CLI/daemon behavior covered by output contracts and
integration tests.

Deployment Notes

• Restart the daemon after installing the new binary so schema migration and
  runtime environment resolution use the new version.
• No new dependency or required environment variable is introduced.
• Recovery refs under refs/acd/recovery/* are intentionally retained for
  operator inspection and restore workflows.