feat(recovery): route failed write-less stages to recovery instead of futile retry

Adds the failure-ticket + recovery-routing mechanism: a deterministic
gate->capability table gates whether a stage has agency to fix its own
failure, opens a FailureTicketOpenedEvent when it doesn't, and routes to
a metadata role=recovery stage (per-stage budget, cap 2, not reset by
TransitionExecuted) instead of retrying in place. Extends salvage
decisions with a RECOVER option so the review-gate judge can also route
to recovery, unifies deterministic-gate and review-gate routing through
routeToRecovery(), and has ExecutionPlanCompiler synthesize a
write-capable recovery stage + edge for freestyle plans. Read-only tools
(file_read, list_dir) are now always available on any tool-granting
stage so a recovery stage can inspect the write-less stage's failure
without flooding context via shell ls -R.

apps/tui-go/internal/app/model.go

@@ -211,6 +211,29 @@ type Session struct {
 	Clar         *Clarification // open questions awaiting answers (clarification view)
 	Propose      *Proposal      // router workflow suggestion awaiting a pick (propose view)
 	Active       bool           // an inference/tool is in flight (drives the spinner)
+
+	// LastReview is the most recent semantic reviewer (Gate 3) verdict for this
+	// session, from review.findings. Nil until the first review lands.
+	LastReview *ReviewResult
+}
+
+// ReviewResult is the semantic reviewer's verdict + findings over a stage's
+// produced files (mirrors ReviewFindingsRaisedEvent).
+type ReviewResult struct {
+	StageID  string
+	Verdict  string // PASS | WARN | FAIL
+	Findings []ReviewFinding
+	Blocked  bool
+}
+
+type ReviewFinding struct {
+	Severity     string
+	Confidence   float64
+	Category     string
+	Target       string
+	Message      string
+	SuggestedFix string
+	Correctness  bool
 }
 
 // Workflow is a launchable workflow advertised by the server.