Add recovery-only drain for gateway demo cutover

[randomblocker]

Add recovery-only drain for gateway demo cutover

Summary

• adds an exact build-time recovery-only mode (NEXT_PUBLIC_GATEWAY_DEMO_RECOVERY_ONLY=1) for the retiring Community-hosted buyer demo
• blocks fresh runs in newly loaded recovery-only pages at both the UI and client dispatch boundary; the rollout requires gateway enforcement for already-open tabs
• preserves origin-scoped, read-only Check & resume for records with a gateway job id, including one another tab learned; records without a job id are never re-POSTed, stay stored, and show their run id and a reconciliation request link
• adds a separate recovery-only Playwright pass with four cases, including direct dispatch-handler invocation; the default config excludes that spec

Why

Browser recovery state cannot move between origins. The old Community page needs a bounded drain phase that preserves read-only recovery for known job ids and provides an operator handoff for other records while the buyer demo moves to its gateway-owned UI.

Rollout

Follow the cutover procedure:

1. Keep this PR draft until the gateway-owned UI is deployed and smoke-tested, and an operator can look up jobs by Idempotency-Key (the browser's run id).
2. Before or atomically with the Community drain deployment, enable gateway enforcement that prevents the retiring Community origin from creating Butler/procurement work while preserving read-only lookup by known job id. Verify fresh starts and unknown-key replays create no jobs, retain browser recovery records, and remain blocked with cached preflights. Community's mocked tests do not verify this external gate.
3. Build and deploy Community with NEXT_PUBLIC_GATEWAY_DEMO_RECOVERY_ONLY=1. next build inlines the flag, so changes require a rebuild. Tabs loaded before deployment keep their previous JavaScript until reloaded; the gateway gate must cover them.
4. Wait at least 12 minutes, reconcile gateway jobs and reported no-job-id run ids, and check again for Community-origin jobs immediately before removing the old pages.
5. Only then merge/deploy Community PR Separate the gateway demo from the Community Directory #84. Keep the gateway gate active after page removal.

Validation

Head fad9954, based on 6c530ac, with main d1de29d already merged:

• git diff --check: clean
• focused unit checks: 16/16 pass; corresponding base tests on d1de29d: 13/13 pass
• Playwright discovery: default config lists 21 tests without the recovery spec; recovery config lists exactly four cases
• recovery browser pass attempted with one worker: Next stops before assertions because the offline sandbox denies os.networkInterfaces() (uv_interface_addresses); the corresponding base browser pass fails at the same startup step
• typecheck: 96 identical diagnostics on head and base, with the private SDK unavailable; none in the changed files
• successful build, provisioned typecheck, and browser assertions need CI on this head before merge; gateway enforcement and operator lookup need separate deployment verification

The author reported 202 passing unit/integration tests, passing typecheck/build, and the original single Chromium recovery case at 803bffb. Those historical results do not validate the current four browser cases.

[randomblocker]

Closing as superseded by #84, which removes the gateway demo from the Community Directory entirely. The Butler-based demo is no longer used, so a drain phase before cutover isn't needed.