SessionRecovery redrive starvation

Trap: repeatedly scanning the oldest 100 expired claims looks bounded and fair, but malformed assistant projections that only log decode defects recycle after the 30-second lease and can permanently starve later valid claims on 10-second scans. Fix: quarantine each poison row by setting recovery_error under its exact Session, execution, owner, live-lease, and null-error fence; test 300 older corrupt rows across three batches followed by valid row 301.