Add Operator recovery for terminal checker infrastructure failure

[Abiorh001]

A terminal infrastructure_failed post-submission checker run cannot be restarted through ordinary re-delivery. This adds a hidden, reason-bound Operator retry through the existing CHECKERS coordinator while preserving the failed run and its evidence.

The command locks TASK → AUTH → CHECKERS and atomically binds the successor generation, immutable retry receipt, authorization evidence, audit event, and outbox request. Exact replay rechecks live authority and remains valid after task completion or a later Submission. Delivery accepts only the original dispatch or an exact committed retry receipt. Uncertain effects are not automatically repeated.

No public retry route or production handler registration is added. Project-configuration faults remain a separate manager-visible hold to implement next, without contributor penalty or changes to submitted rules. The roadmap and current change record reflect this boundary.

Verification:

• Exact head dd27cc884c2e6f3035e6791b9546671689af3cab; hosted merge 189f215cd3ef96b2a68919cdd997d05dc0de09a5 has the same tree.
• Backend run 38158674618 passed all ten lanes and aggregate checks. Independently validated 9,204 unique collected and completed tests, zero skips/deselections/omissions, matching evidence digests, and complete PostgreSQL/MinIO cleanup.
• Focused PostgreSQL proofs cover authority revocation, concurrent requests, real audit-insert rollback, immutable receipt custody, retained-evidence migration, accepted-task replay, and replay after replacement Submission. A real MinIO task-import tamper proof also passed.
• Applicable security, architecture/reuse, QA/test-delta, documentation/product-operations, and final CI-integrity reviews passed. Required GitHub checks pass; no unresolved review threads.
• Existing test consumers were corrected and four modules redistributed across the same ten lanes, preserving the complete test inventory and unchanged 1,200-second cap. The slowest runner took 1,172.646 seconds: only 27.354 seconds of margin remain.
• CodeRabbit skipped substantive review because reviews are disabled for this stacked base branch; its green status is not a review.

Stacked on #537. Merge #537 first, then reconcile this PR with main and revalidate. Human review focus: exact Operator authority, historical replay, TASK → AUTH → CHECKERS lock order, and atomic database receipt closure. No merge has been performed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b28e027f-73be-43ee-ab07-6c1f14b90403

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}