feat(agent): W4-E2 in-grant auto recovery for decisions with verified outcome

- settings.agent.autoInvestigateMode investigate|recover, investigateMaxAttempts, recoverVerifySec
- new capability download.recheck (execute, replay never): qB force recheck / resume, no source swap/delete
- autoInvestigate moves to agent/investigate.ts: recover mode runs execute with a recovery allowlist
  only when an active grant (published policy if bound) covers the recovery actions; otherwise degrades
  to read-only investigation and leaves suggestion + recheck option on the decision
- runAgent verifies recovery against business facts (download_task/task/source_release) before finalize;
  verified -> decision resolved by system:auto-recover, run summary '已恢复(系统核实)'; otherwise stays
  awaiting_user; per-root-cause attempt cap
- e2e E6: missingFiles -> download_failed -> recheck -> verified; no grant degrades; swap rejected;
  dedupe; attempts exhausted; budget exceeded keeps attention

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/settings.ts

@@ -73,8 +73,22 @@ export type PiSettings = z.infer<typeof PiSettings>;
  * 上游/模型/思考档位在 pi 分组;pi.provider = "fake" 时使用脚本化假模型(不联网,演示与 e2e 用)。
  */
 export const AgentRuntimeSettings = z.object({
-  /** 识别歧义 / 下载失败诊断等待处理事项创建时,自动发起有界只读调查 */
+  /** 识别歧义 / 下载失败诊断等待处理事项创建时,自动发起有界调查 */
   autoInvestigate: z.boolean(),
+  /**
+   * 自动调查的模式:investigate = 只读调查,结论交还人工;
+   * recover = 在已发布策略 / 持续授权范围内可执行恢复类能力(task.retry、download.recheck、identity.resolve),
+   * 换源、删除、清理始终排除;没有覆盖的授权时自动降级为 investigate。
+   */
+  autoInvestigateMode: z.enum(["investigate", "recover"]),
+  /** 同一根因(decision 去重键)最多自动恢复几次;用尽后只交还人工,不再唤醒模型 */
+  investigateMaxAttempts: z.number().int().min(1).max(10),
+  /** 恢复动作后等待业务事实(下载状态 / 任务状态)核实的最长时间(秒) */
+  recoverVerifySec: z
+    .number()
+    .int()
+    .min(5)
+    .max(24 * 3600),
   /** 单次运行:工具调用次数上限 */
   maxToolCalls: z.number().int().min(1).max(500),
   /** 单次运行:时长上限(秒) */
@@ -165,6 +179,9 @@ export const DEFAULT_SETTINGS: GlobalSettings = {
   },
   agent: {
     autoInvestigate: false,
+    autoInvestigateMode: "investigate",
+    investigateMaxAttempts: 2,
+    recoverVerifySec: 600,
     maxToolCalls: 40,
     maxDurationSec: 900,
     maxTokensPerRun: null,