Diagnose the rejected standby pause without changing database state #4697

🤖 Generated by the Agentic Engineer

The separately approved standby recovery stopped at its first conditional pause patch, without changing the database or its storage. Retrying a recovery is not an appropriate way to learn why that request was rejected.

Provide a separately confirmed, protected diagnostic that runs that exact patch once with server-side dry-run. It must use reviewed current main, the first dispatch attempt, the production environment and the existing deployment lock. Keep the same source, identity, backup, healthy-peer, retained-volume and operator guards. Reject any combination with execution or continuation flags before contacting the cluster.

The diagnostic must stop after the one dry-run patch on success or failure. It must not pause reconciliation, fence a database, delete a job or claim, or perform a cleanup write. Report only the bounded error categories from #4695; never publish raw server errors, identifiers or credential material. A passed dry-run is a current observation, not permission to retry recovery.

Acceptance: regression tests prove the fixed dispatch boundary, identical pause-patch preconditions, the required server-side dry-run argument, and no later command or persisted mutation on either outcome. A negative control without the dry-run argument must fail. Complete reviewed delivery separately from authorization to run the diagnostic.

Related: #4673. Merge the reporting change in #4696 before using this diagnostic. Production execution remains awaiting a separate diagnostic approval; the consumed recovery approval is not reused.