Bounded, tenant-qualified recovery for interrupted planning and push targets.
Recovery only exposes durable IDs and closed reason tokens. Target execution is
still authorized by DeliveryTargets.begin_target_attempt/2; discovery is never
provider-call authority.