SessionRecovery reserved continuation

Trap: excluding recovery continuations only from ordinary queue selection looks sufficient, but public retries, replayed execution requests, steer promotion, ordinary wake scans, or exact promotion racing validation can still execute stale work. Fix: treat every session_recovery.continuation_message_id as internal; reject ordinary wake/admission paths and atomically validate canonical ID, Session, prompt, delivery, phase, assistant relationship, and newest-assistant status inside exact promotion. Quarantine only after rollback.