Fix RecoveryClass persistence in durable agent execution

[jsilvanus]

Goal

Preserve the declared recovery semantics of each operation when AgentLoopTaskRunner persists durable attempts.

Why

The durable executor relies on attempts.recovery_class to decide how an interrupted operation may be recovered. The current tool-call path resolves the tool descriptor but persists IDEMPOTENT unconditionally, which can incorrectly classify UNSAFE effects as replayable.

Plan

• Carry the tool descriptor's declared RecoveryClass through the tool-call execution path.
• Persist that class on the corresponding attempt instead of hardcoding IDEMPOTENT.
• Verify the model-call recovery classification against the current contract.
• Add regression coverage for PURE / IDEMPOTENT / UNSAFE tool classifications.
• Add a recovery regression proving an interrupted UNSAFE attempt becomes INDETERMINATE and is not replayed.
• Run the relevant JVM tests and repository checks.

Scope

This PR intentionally does not address egress enforcement, actor attribution, MCP wiring, worker orchestration, Android hardware validation, or schema changes.

Related to the durable execution/recovery work in RFC-0009 and the MVP pipeline.