review-graph: support recovery from validator launch failures #69

A transient sandbox failure before validation starts leaves a review graph with no documented recovery path, even when the source state is unchanged and ordinary tool permission escalation could address the failure.

Observed while reviewing research-repo-tools issue #22 with dotfiles skills at commit 7acf42f2b01ea6d1ec39eb45fda832fed35109d1:

1. Eight read-only audit/independent nodes completed and compiled successfully against one unchanged source state.
2. The baseline validator ran its single dispatched just check attempt. The first command, uv run --locked actionlint, failed initializing the inherited uv cache: failed to open .../sdists-v9/.git: Operation not permitted (os error 1). No actual check ran; elapsed time was about 0.039 seconds. This was an execution sandbox denial, not an automatic approval-review rejection.
3. The validator published an accurate blocked payload. Compilation retained that evidence and journaled the node as blocked.
4. next-ready then returned no ready nodes: blocked nodes prevent completion: validation-001. Two newly discovered validation requirements also needed expansion, but expansion rejects any blocked node.

The worker instructions say to execute each command exactly once; review-graph says to run each coalesced unit once and never replay equivalent checks. The materializer's duplicate_command_authorizations explicitly excludes validation nodes. Documented continuation operations cover source repairs, external metadata changes, and unstarted-worker fallback; none covers this unchanged-source launch failure. Changing source or Git metadata just to unlock the lifecycle would be incorrect.

Please add a bounded, provenance-preserving recovery policy for infrastructure/launch failures:

• Preserve the failed attempt, payload, log, snapshots, and journal event.
• Allow a new runtime-bound attempt after the specific blocker is addressed, with the permission/environment difference and reason recorded explicitly.
• Keep successful equivalent validation from being replayed, and retain actual check failures as owner evidence.
• Preserve accepted audits; permit pending independent validation and synthesis to resume when the required validation is resolved.
• Add regression tests for a cache-permission launch failure followed by a permitted successful retry, unchanged source identities, immutable original evidence, and late-validation expansion.

A documented sanctioned recovery flow would also resolve this if one already exists. Current user-visible impact: the review found three source issues, but its formal validation/proof and dependent synthesis remain incomplete despite unchanged source and recoverable cache access.