feat: guide qualification and recover local run history

[abrichr]

Summary

• add a compact qualification journey from environment review through export or deployment
• replace raw case JSON with typed local input fields while retaining an advanced exact-JSON option
• link certification refusals to the correct risk, identity, effect, or case control
• derive runner compatibility only from signed current-revision capability observations
• persist each run and its outcome atomically
• retain a bounded local recovery record when history storage fails, show the report as degraded, and let Watch Run or Teach retry safely
• prevent Teach from selecting an older or incomplete run while a newer run still needs history reconciliation

Verification

• npm run test:ui: 68 passed
• npm run build: passed
• focused engine and database suite: 72 passed, 1 optional presentation-export test deselected because this isolated environment does not install openadapt-types
• Ruff check on changed Python files: passed
• public source-boundary check: passed

Remaining Flow and API dependencies

• Flow must expose required/default/enum-choice metadata for each parameter before Desktop can validate every typed case input without the advanced JSON view.
• Flow needs graph-edit commands for inferred parameters, branches, loops, and actions. Desktop can inspect the graph today but cannot safely rewrite those nodes through a stable API.
• Flow needs typed verifier discovery and binding. Desktop can set required evidence tiers today, but the concrete verifier still comes from the deployment configuration.
• Flow must expose the complete target-state fault-case taxonomy and reusable case templates beyond the current representative, ambiguity, identity, and effect cases.
• A stable execution-profile API is still required so Desktop can select Demo, Standard, or Regulated without hard-coded policy names.
• Secret-reference metadata needs a typed Flow contract. Desktop currently keeps values out of the project and shows the deterministic runner environment reference.
• The deployment API must return durable artifact and deployment lineage before the final journey step can show a past deployment instead of only current readiness.

PR relationship

Desktop PR #85 changes the phone-decision portal and private Flow configuration from an older base. This branch does not change those files. Rebase or merge #85 independently after its current-main compatibility review.