feat(agent): W4-E2 in-grant auto recovery for decisions with verified outcome

- settings.agent.autoInvestigateMode investigate|recover, investigateMaxAttempts, recoverVerifySec
- new capability download.recheck (execute, replay never): qB force recheck / resume, no source swap/delete
- autoInvestigate moves to agent/investigate.ts: recover mode runs execute with a recovery allowlist
  only when an active grant (published policy if bound) covers the recovery actions; otherwise degrades
  to read-only investigation and leaves suggestion + recheck option on the decision
- runAgent verifies recovery against business facts (download_task/task/source_release) before finalize;
  verified -> decision resolved by system:auto-recover, run summary '已恢复(系统核实)'; otherwise stays
  awaiting_user; per-root-cause attempt cap
- e2e E6: missingFiles -> download_failed -> recheck -> verified; no grant degrades; swap rejected;
  dedupe; attempts exhausted; budget exceeded keeps attention

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/capability.ts

@@ -57,6 +57,7 @@ export const CAPABILITY_IDS = [
   "identity.resolve",
   "download.plan",
   "download.submit",
+  "download.recheck",
   "organize.plan",
   "organize.execute",
   "task.inspect",
@@ -171,6 +172,17 @@ export const CAPABILITY_CATALOG: Record<KnownCapabilityId, CapabilityDescriptor>
     true,
     false,
   ),
+  "download.recheck": d(
+    "download.recheck",
+    "重新校验/恢复下载",
+    "对已纳管的下载任务发起强制重新校验(action=recheck)或恢复非阈值、非人工的暂停(action=resume);不换源、不删除、不改保存路径",
+    "execute",
+    "DownloadRecheck",
+    "organize.execute",
+    "medium",
+    true,
+    false,
+  ),
   "organize.plan": d(
     "organize.plan",
     "生成整理计划",