release: v0.11.0 workflow path recommendation

[MageByte-Zero]

Summary

• add ssf workflow recommend, select, and show to collect minimal intake facts, explain the recommended full / hotfix / tweak path, and wait for explicit user choice
• persist tamper-evident workflow recommendation/selection receipts with safe recovery states and DP-0 audit summaries
• route workflow-start through cold-start initialization, missing-fact collection, recommendation display, and user selection while keeping DP-4 execution-mode selection separate
• preserve legacy runtime infer behavior and existing fast-path thresholds
• merge four canonical capability specs and prepare all release-managed files for v0.11.0
• include the changes delivered since v0.10.0 for 希望增加恢复和切换需求/命令 #47, 状态机有问题 closing #64, spec-writer 应继承用户对话语言生成规划工件 #65, and hotfix closing 守卫错误要求 tasks.md #71 in the v0.11.0 changelog

Why

Previously, a new requirement with no planning artifacts could be treated as a full-workflow decision even though the system only lacked enough information to classify it. The new intake control plane distinguishes missing facts from a genuine full recommendation, explains all available paths, and records the user's explicit selection for recovery and audit.

Notable safeguards

• recommendation never mutates state.workflow
• selection requires a valid ready receipt, --confirm, and an explicit reason; non-recommended choices also require acknowledgement
• receipt content uses stable SHA-256 and atomic replacement; tampering is rejected
• malformed commands and failed selections leave receipt/state/DP-0 unchanged
• show recovers missing, needs-input, invalid, selection-pending, selected, and explicit-state contexts in JSON and human-readable output
• brand-new changes initialize state before collecting the six fixed intake facts
• version sync and consistency checks now cover package-lock metadata and recovery command runtime pins

Validation

• Node 20 full suite: 522/522 passed
• raw package smoke: 1/1 passed
• recovery command assets: 13/13 passed
• WorkBuddy tests: 12/12 passed; temporary install verified 9 skills and 3 commands
• TypeScript build, doctor, skill lint, artifact validation, version consistency, v0.11.0 dry-run (Changed: 0), and diff checks passed
• six SDD waves have independent PASS review receipts; final whole-branch review has 0 Critical and 0 Important findings
• four canonical specs merged without conflict: 12 requirements / 21 scenarios

Release boundary

This PR prepares the v0.11.0 release candidate only. It does not create a tag, publish to npm, create a GitHub Release, or write to an external marketplace. The PR should remain draft until GitHub Node 20/22, platform smoke, and Plugin Scanner checks are green.

Closes #70