feat: add d601 recovery guardrails

Adds read-only D601 recovery diagnostics, fixture coverage, CLI wiring, and recovery hotfix runbook updates. Validated with recovery contract, check --files, scripts tsc, artifact matrix direct contract, and read-only live diagnostic.

scripts/cli.ts

@@ -4,7 +4,7 @@ import { isRebuildableService, rebuildService, stackLogs, stackStatus, startStac
 import { parseE2ERunOptions, runE2E } from "./src/e2e";
 import { emitError, emitJson } from "./src/output";
 import { jobWithTail, listJobs, listJobsSummary, readJob, runJob } from "./src/jobs";
-import { checkHelp, parseCheckOptions, runChecks } from "./src/check";
+import { checkHelp, parseCheckOptions, runChecks, runRecoveryGuardrailsCheck } from "./src/check";
 import { runSsh } from "./src/ssh";
 import { autoRemoteCiPublishUserServiceDryRunPlan, extractRemoteCliOptions, runRemoteCli } from "./src/remote";
 import { runMicroserviceCommand } from "./src/microservices";
@@ -291,6 +291,12 @@ async function main(): Promise<void> {
       emitJson(commandName, checkHelp());
       return;
     }
+    if (sub === "recovery-guardrails") {
+      const result = runRecoveryGuardrailsCheck(config);
+      emitJson(commandName, result, result.ok);
+      if (!result.ok) process.exitCode = 1;
+      return;
+    }
     const result = runChecks(config, parseCheckOptions(args.slice(1)));
     emitJson(commandName, result, result.ok);
     if (!result.ok) process.exitCode = 1;