feat(server,fs): W5-E production fsworker role, settings auto-investigate mode, replace old file to trash_item

- main.ts: `--role fsworker` dispatched before the rest of the module graph is
  loaded (other imports became dynamic); runs fsWorkerMain from the new
  `@umt/adapters/fsworker` export (~150 ms startup in the compiled binary)
- fsproxy: default worker command picked per runtime (deno CLI -> `deno run
  fsworker.ts`, compiled binary -> `<execPath> --role fsworker`); stats expose
  workerKind; UMT_FS_TEST_HANG_AFTER_BYTES acceptance switch for containers
- compile: --allow-run adds /app/umt-server (spawn self); start task allows deno
- organize: replaced old file moved into the file-manager trash layout
  (<root>/.umt-trash/<day>/<uuid>/<rel>) and registered in trash_item, ledger
  result follows; organize.transfer log carries fsproxy stats
- settings: autoInvestigateMode (investigate/recover) + max recover attempts
- deploy.md: container verification (subprocess self, TIMEOUT -> SIGKILL x3)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/routes/console/settings/prefs-tab.tsx

@@ -228,17 +228,37 @@ const AGENT_BUDGET_CARD: CardSpec = {
 
 const AGENT_RUNTIME_CARD: CardSpec = {
   title: "Agent 运行",
-  description: "单次运行预算、后台自动调查;provider 选 fake 时按下面的脚本回放工具调用(留空用内置演示脚本)。",
+  description:
+    "单次运行预算、后台自动调查(只读调查或授权内恢复);provider 选 fake 时按下面的脚本回放工具调用(留空用内置演示脚本)。",
   fields: [
     { name: "agent.maxToolCalls", label: "单次工具调用上限", kind: "number", hint: "1 – 500" },
     { name: "agent.maxDurationSec", label: "单次时长上限(秒)", kind: "number" },
     { name: "agent.autoInvestigate", label: "待处理事项自动调查", kind: "switch" },
+    {
+      name: "agent.autoInvestigateMode",
+      label: "自动调查模式",
+      kind: "select",
+      options: [
+        { value: "investigate", label: "只读调查(结论交还给你)" },
+        { value: "recover", label: "授权内恢复(可重试任务 / 重新校验 / 确认识别)" },
+      ],
+      hint: "恢复只在已发布策略或持续授权覆盖时执行,换源、删除、清理始终排除;没有覆盖的授权时自动退回只读调查",
+      wide: true,
+      visible: (v) => v["agent.autoInvestigate"] === true,
+    },
     {
       name: "agent.investigateMaxToolCalls",
       label: "自动调查工具调用上限",
       kind: "number",
       visible: (v) => v["agent.autoInvestigate"] === true,
     },
+    {
+      name: "agent.investigateMaxAttempts",
+      label: "同一根因最多自动恢复",
+      kind: "number",
+      hint: "1 – 10 次,用尽后只交还给你",
+      visible: (v) => v["agent.autoInvestigate"] === true && v["agent.autoInvestigateMode"] === "recover",
+    },
     { name: "agent.goalPollSec", label: "目标落定轮询(秒)", kind: "number" },
     { name: "agent.goalWaitHours", label: "目标最长等待(小时)", kind: "number" },
     {
@@ -260,7 +280,9 @@ const AGENT_RUNTIME_CARD: CardSpec = {
     "agent.maxToolCalls": n(s.agent.maxToolCalls),
     "agent.maxDurationSec": n(s.agent.maxDurationSec),
     "agent.autoInvestigate": s.agent.autoInvestigate,
+    "agent.autoInvestigateMode": s.agent.autoInvestigateMode,
     "agent.investigateMaxToolCalls": n(s.agent.investigateMaxToolCalls),
+    "agent.investigateMaxAttempts": n(s.agent.investigateMaxAttempts),
     "agent.goalPollSec": n(s.agent.goalPollSec),
     "agent.goalWaitHours": n(s.agent.goalWaitHours),
     "agent.fakeScript": s.agent.fakeScript ?? "",
@@ -271,7 +293,9 @@ const AGENT_RUNTIME_CARD: CardSpec = {
       maxToolCalls: num(v["agent.maxToolCalls"]),
       maxDurationSec: num(v["agent.maxDurationSec"]),
       autoInvestigate: v["agent.autoInvestigate"] === true,
+      autoInvestigateMode: v["agent.autoInvestigateMode"] === "recover" ? "recover" : "investigate",
       investigateMaxToolCalls: num(v["agent.investigateMaxToolCalls"]),
+      investigateMaxAttempts: num(v["agent.investigateMaxAttempts"]),
       goalPollSec: num(v["agent.goalPollSec"]),
       goalWaitHours: num(v["agent.goalWaitHours"]),
       fakeScript: str(v["agent.fakeScript"]).trim() || null,