[Feat] Add bounded recovery for stalled browser and desktop tasks

[prettygirlisnotme]

Why

Browser and desktop policies can repeatedly choose ineffective actions without recovering or explaining how to proceed. This adds bounded replanning for those stalls, following the small repeatable recovery on/off subset agreed in #16.

How

Start with s1a/recovery.py for the cumulative attempt/time budget, s1a/browser/decision_model.py for browser triggers and refreshed observations, and s1a/tool/rethink.py for desktop integration.

A stall spends an attempt, refreshes the observation read-only, and asks the existing chat model for a short plan. The next ordinary decision consumes that plan through the existing tools and permission checks. Progress does not refund attempts or active refresh/planning time. Failed, cancelled or exhausted recovery stops with a reason and a next action.

Failed observations cannot become empty-page DONE results. A partial answer after post-replan BLOCKED remains context and cannot make the task successful. Failed/cancelled calls remain visible in accounting; unknown usage or prices do not become zero cost.

What

• Opt-in browser recovery with --rethink on; --rethink-attempts and --rethink-timeout bound recovery. Desktop recovery reuses RethinkRail while preserving existing game behavior.
• Recovery records, regression tests, independent browser/Windows completion checks, and paired evaluation runners. The full [Eval] Add repeatable browser and desktop task suites #13 suite and [Feat] Extend desktop execution to typing, keyboard input, and scrolling #15 desktop operation extensions remain outside this change.
• A real-model report and 24 per-trial records, including protocol, provenance and limitations. Feature documentation and changelog are updated.

Verification

• Formatting, lint and types: .venv/bin/ruff format --check ., .venv/bin/ruff check ., .venv/bin/ty check.
• .venv/bin/pytest -q: 638 passed, 41 skipped, 98 subtests.
• S1A=.venv/bin/s1a PY=.venv/bin/python scripts/smoke.sh.
• uv build --offline: source archive and wheel built successfully.
• CHANGELOG.md and feature documentation updated.

Opt-in system tests: S1A_BROWSER_TESTS=1 .venv/bin/pytest -q tests/system/test_recovery_browser.py passed on the cluster (74.34 s); S1A_DESKTOP_TESTS=1 .venv/bin/pytest -q tests/system/test_recovery_desktop.py passed against a dedicated Windows fixture. Controlled browser/Windows subsets completed 12/6 trials without execution errors. Their scripted decisions and plans validate mechanics, not neural-model performance.

With real Laya 0.3.5 and DeepSeek v4.1 Flash, the original 12-trial matrix verified 0/6 in both arms and never triggered recovery. A separately reported exploratory server-validation variant verified 0/6 off and 2/6 on, with six planner calls. Paired mean overhead was 18.194 s, two decision calls, 0.83 chat calls and one unchanged-page action per task. Locked-form trials still failed despite correct plans. These small synthetic results do not establish a general success-rate improvement.

The final post-replan BLOCKED correction affects terminal reporting and was regression-tested after the frozen experiment; historical outcomes remain unchanged. See the report and eval guide for reproduction settings.

Closes #16.