Validate C++ disaster recovery traces with Lean

[Amaury Chamayou (achamayou)]

Summary

Part 4/4 of the replacement stack for #8241. This PR validates real C++ recovery-decision-protocol executions against the permanent Lean model introduced below it.

Stack:

• Add the C++-aligned Lean disaster recovery model #8277
• Validate the Lean disaster recovery model against Stateright #8279
• Remove the superseded Stateright disaster recovery model #8280
• this PR

This PR depends on draft deletion PR #8280 and must remain gated until the lower layers are ready.

Approach

• Defers the production host restart until the JOINING state transaction globally commits in both default and trace-enabled builds. In trace-enabled builds, the committed join_restart observation is emitted before restart is requested. This is a commit-before-restart guarantee, not an exactly-once guarantee.
• Adds the OFF-by-default CCF_RECOVERY_TRACE option, a commit-aware trace table, versioned RDP_TRACE records, per-node sequences, message IDs, causal IDs, exact ordered retry-send batches, accepted receives, committed timeouts, and one-shot effects.
• Adds an isolated package at lean/disaster-recovery-trace/. It depends locally on ../disaster-recovery and imports only DisasterRecovery.Protocol.Model; no trace modules or targets are added to the canonical package.
• Defines and documents the strict ccf.recovery_decision_protocol.trace/1 NDJSON contract. The validator rejects the shortest incompatible prefix and checks parser/replay behavior without treating synthetic tests as implementation evidence.
• Extracts records from each node, validates identity, sequence, message IDs, and causal edges, deterministically topologically orders them, writes *.recovery.ndjson, and invokes the isolated validator.
• Wires quorum, failover, and repeated-timeout recovery scenarios into the Milan and Genoa SNP jobs. Those jobs build with tracing enabled and upload captured NDJSON even on failure.

Evidence and isolation

Real captured C++ SNP traces are the implementation conformance evidence. Small in-memory Lean and Python tests cover rejection, extraction, and ordering only.

lean/disaster-recovery/ remains byte-for-byte unchanged. This PR does not recreate lean/disaster-recovery-migration/ or tla/disaster-recovery/, and contains no migration, Rust, or Stateright code.

Validation

• Built node_frontend_test with CCF_RECOVERY_TRACE both OFF and ON.
• Ran node_frontend_test through each build's tests.sh wrapper.
• Ran the focused Python extraction/ordering suite (8 tests).
• Ran lake exe cache get, lake build, warnings-as-errors/no-sorry checks, and lake exe trace-checks for the isolated package from a shorter temporary checkout. The generated Copilot worktree path is long enough to expose a local Lake output-directory issue; the same committed package builds successfully at the shorter path used by normal CI checkouts.
• Ran scripts/ci-checks.sh -f successfully.

Gates

Keep this PR in draft while #8280 remains gated. The coordinator will add GitHub preview stack metadata after all four PRs pass preflight.