Harden recovery verification and submission runbook

[batbrainy]

Closes #35

Problem

Post-merge review found that the recovery verifier could recreate the worker in live mode,
suppressed fixture one-shot failures, and printed persistence counts without asserting them.
The reviewer runbook also mixed live and fixture state, overstated replay guarantees, and no
longer matched the intended two-page design brief.

Scope

• pin every recovery-script Compose call to the default fixture corpus
• treat fixture, crash-injector, and test-service subprocess failures as failed checks
• assert push-event preservation across operator stops, real process crashes, and normal restart
• preserve the Docker API-stop negative control separately from host-PID process-crash recovery
• make test-isolation cleanup restore the worker even on failure
• narrow replay/recovery wording to the proved event-row and entity-activity invariants
• split cold live startup from an explicit empty-volume fixture phase
• correct queue/database transaction and recovery descriptions
• compress the design brief to 982 words with one architecture diagram and one trade-off table
• mark the old recovery transcript as historical without rewriting its raw output

There are no schema, public API, endpoint, or Compose topology changes.

Validation

• docker compose run --rm --build test: 1,734 examples, 0 failures
• stress suite: 10 examples, 0 failures
• focused Compose/recovery spec: 54 examples, 0 failures
• RuboCop: 231 files, no offenses
• Brakeman: 0 warnings
• Bundler Audit: no vulnerabilities
• bash -n script/verify_recovery.sh
• docker compose config --quiet
• all 23 tracked Markdown files: local targets and checked anchors resolve
• forbidden-claim scan: remaining matches are negations/limitations only
• temporary US Letter render at 11pt/0.75-inch margins: 2 pages, visually inspected

Follow-up gate

After CI passes and this PR merges, the complete submission checklist will be rerun from a
fresh clone of the resulting default-branch SHA. The submission email remains blocked until
that run is completely green.