fix: scope recovery cycles and gate stage completion

[Stahl-G]

Summary

• scope owner revisions and stale-artifact baselines to the latest contamination cycle
• fail closed when a recovery revision after the latest contamination is bound to another cycle
• apply the canonical recovery veto to every stage-completion transaction, not only finalize-complete
• preserve valid downstream reruns after a bound repair or supersede transaction

Root cause

PR #483 evaluated recovery only inside the finalize-complete branch, so ordinary
state stage-complete could advance an unrecovered contaminated run. Its recovery
projection also exposed the absolute latest owner revision before selecting the
latest contamination cycle, allowing an older cycle's stale baselines to leak
into awaiting_recovery and repair_in_progress states.

Authority boundary

• recovery_state.py remains the sole recovery-cycle interpreter.
• stage_completion.py consumes that state as a transaction veto; it does not
  infer recovery from raw events or artifacts.
• awaiting_recovery, repair_in_progress, and invalid recovery states reject
  ordinary stage completion before any control-file write.
• not_applicable and a valid downstream_rerun_pending state remain eligible
  for the existing stage target and artifact checks.

MU-3 isolation

This hotfix is based directly on main after #483. It does not modify
artifact_registry.py, tests/test_runtime_state.py, intake contracts, quality
gates, or materiality selection, so it stays separate from draft #484 / MU-3.

Validation

• focused recovery/runtime slice: 63 passed
• full pytest: 2848 passed
• Ruff and compileall
• scripts/check_release_consistency.py --no-tag
• scripts/check_product_baseline.py
• scripts/check_capabilities.py
• scripts/check_version_consistency.py
• git diff --check