Fix Rescue task boundaries and automatic routing

[vitry]

Summary

• preserve the complete Rescue business objective while excluding Codex host stop/report/review policy
• add Root-managed proactive fresh/resume routing, active-child rejoin, and explicit one-time choice behavior
• deliver the task through a private raw-TTY prepared envelope consumed by task-blind named/generic Rescue children
• synchronize the managed Role, docs, qualification evidence, and marketplace snapshot

Validation

• npm run check
• git diff --check
• independent per-task spec and quality/security reviews
• whole-branch Standards and Spec reviews from 7680b94

Default qualification is credential-free. Authenticated Codex/ZCode E2E remains an explicit opt-in structured skip and is intended for manual E2E validation.

Upgrade note

Run $zcode:setup after installing the updated plugin so the digest-backed managed Rescue Role is reconciled before use.