fix(mcp): block manual daemon killing as workflow recovery (Closes #630)

A session that ran `pkill -f mcp_server.py`, waited for the IDE to respawn
the daemons, and then closed an issue left no trace distinguishing that
closure from one performed over a sanctioned runtime. Detection existed only
as advisory strings (`native_mcp_preference.classify_command_path`,
`review_workflow_boundary`) and never failed closed on the mutations that
followed.

Adds `runtime_recovery_guard.py`, mirroring the #671 stable-branch
contamination model so the two cannot drift apart: classification of
kill/pkill/killall commands and known-pid kills, a durable
`runtime_recovery_contamination` marker, a fail-closed pre-flight gate over
the shared review/merge/close/completion task set, and reconciler-only
clearing. `comment_issue` and `lock_issue` stay allowed so a contaminated
worker can still post its audit comment and hand off. The marker is
recovery-critical, so contamination cannot expire into cleanliness with the
session-state TTL.

Read-only inspection (`ps aux | grep mcp_server`), sanctioned reconnects,
and process management unrelated to the daemons are never flagged; a bare
`kill` of an unknown pid is reported as ambiguous rather than contaminating,
so ordinary subprocess work is not false-blocked. A pattern broad enough to
sweep unrelated namespaces (`pkill -f python`) is contamination even when it
never names MCP.

Operator-authorized host maintenance stays permitted, but the authorization
is read from GITEA_OPERATOR_DAEMON_MAINTENANCE_AUTHORIZATION in the process
environment only and never from a tool argument, so a session cannot
authorize itself.

Final-report rules reject clean-session claims and require the contaminated
recovery to be surfaced. Two tools are registered (inventory 112 to 114) and
the sanctioned-versus-forbidden contrast is documented in the namespace
recovery doc and the workflow skill.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

mcp_session_state.py

@@ -36,6 +36,11 @@ KIND_REVIEW_DRAFT = "review_draft"
 # other session proofs; a contaminated session fails closed on gated mutations
 # until a reconciler audits and clears it.
 KIND_STABLE_BRANCH_CONTAMINATION = "stable_branch_contamination"
+# Durable marker set when a worker session manually kills MCP daemon processes
+# instead of using a sanctioned reconnect/restart path (#630). Same shape and
+# same reconciler-only clear as the #671 marker above; kept as its own kind so
+# an audit can tell the two contamination classes apart.
+KIND_RUNTIME_RECOVERY_CONTAMINATION = "runtime_recovery_contamination"
 # Durable shadow of the in-memory reviewer session lease (#702). Written on
 # every sanctioned record/heartbeat and removed on sanctioned clear, so a
 # daemon that dies without teardown leaves provable orphan evidence (owner
@@ -71,6 +76,10 @@ RECOVERY_CRITICAL_KINDS = frozenset(
         # #702 crash-orphan evidence (must outlive TTL; F4)
         KIND_REVIEWER_SESSION_LEASE,
         KIND_STALE_BINDING_RECOVERY,
+        # #630: contamination must not expire into cleanliness. A TTL-bound
+        # marker would let a contaminated session self-clear by waiting, which
+        # defeats the reconciler-only clear the gate depends on.
+        KIND_RUNTIME_RECOVERY_CONTAMINATION,
     }
 )