Keep unadopted release recovery repository-owned #722

🤖 Generated by the Agentic Engineer

Outcome

Keep the unadopted release-recovery procedure repository-owned rather than advertising a reusable workflow with no production consumers. This completes the remaining zero-consumer export correction in the portfolio workflow-ownership cleanup.

Acceptance

• Make the existing recovery workflow a default-off manual workflow owned by this repository, not a public workflow_call interface.
• Preserve explicit confirmation, reviewed default-branch/public-repository admission, immutable source, normal release serialization, build-before-credentials, repository-scoped read admission before any writer credential, historical tag/source/run verification, and no-op readback.
• Keep complete credential-free native offline/disabled controls as an explicitly internal generated projection, with parity and omission/mutation checks. Fixtures do not count as production adoption or a reason to export the workflow.
• Update the catalogue, invocation instructions and regression checks together. No new App, permission expansion, production recovery or rollout-flag retirement is authorized by this structural correction.
• Full exact-head CI, substantive clean review, protected merge and post-merge verification.

The complete current source census found zero production job-level callers and two internal CI fixtures. #603 remains open for a real protected recovery and the opt-in lifecycle; fixture evidence does not satisfy that rollout.

Related: #693, #603, #587.