feat(orchestration): implement Mode-2 route_to reroute-to-alternate recovery

[bug-ops]

Summary

• Implements Mode-2 route_to reroute-to-alternate-node recovery for the orchestration scheduler (spec 075-orchestration-node-control-parity FR-D-01), the LangGraph node-error-handler parity mode deferred from PR spec(075-orchestration-node-control-parity): add specification #6242 after the original naive design (dependency-based dormancy) was found unworkable during a three-round architect/critic review (N5/N1/N3).
• New non-terminal TaskStatus::Dormant state, RecoveryAction.route_to: Option<TaskId> on-failure activation edge, and a completion-time resolve_dormant_after_terminal sweep close N5 (dormancy inversion), N1 (Skip-BFS stranding the fallback's subtree), and N3 (Failed-source output never reaching the fallback's prompt).
• DispatchStrategy::LevelBarrier now treats Dormant as parked and lets an activated fallback dispatch out-of-level, closing a livelock where a route_to source deeper than its depth-0 fallback would never get scheduled.
• /plan retry re-arms a previously-activated fallback branch back to Dormant so retry semantics compose correctly with a prior reroute.
• A rerouted source stays terminal Failed even inside a Completed graph (by design, to keep the Completed-only aggregator/grounding filters from leaking the failure's error into synthesis) and is now tallied into tasks_failed.
• A review round caught that the routed_from prompt injection read TaskNode.result, which no production Failed-transition path populated — only the Completed handler and Mode-1's try_recover wrote it, so the failed-source context injection silently rendered empty outside the one test that hand-fabricated .result. Fixed by populating .result at all three Failed-transition sites in tick/mod.rs, and replaced the masking test with one that drives the real handle_failed_outcome/tick() path end-to-end.
• No config/CLI/wizard/migration surface: route_to, like Mode-1's state_injection, is authored programmatically rather than exposed to the LLM planner schema.

Design process

Full architect → critic (2 rounds) → developer → (tester, perf, security, impl-critic) → reviewer (2 rounds) chain. Design and review handoffs: .local/handoff/2026-07-16T22-{20-21,28-07,41-21,47-11}-*.md, .local/handoff/2026-07-16T23-{27-47,33-22,33-57,35-46}-*.md, .local/handoff/2026-07-17T{01-23-28,01-37-49,01-57-22}-*.md.

Closes #6244

Test plan

• 34 new unit/integration tests across dag.rs, scheduler/mod.rs, scheduler/planner.rs, scheduler/router.rs, zeph-core::compaction_e2e — including the two D4 LevelBarrier hang scenarios, a resume_from-specific Dormant-stays-Dormant regression, and an end-to-end real-failure-path prompt-injection test
• cargo +nightly fmt --check clean
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings clean
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 13912/13912 passed, 0 failed, zero regressions
• Rustdoc gate (RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace) clean
• Workspace doc-tests clean
• gitleaks protect --staged clean
• Live /plan session test — not yet possible, route_to has no LLM-facing authoring surface yet (same constraint as Mode-1's state_injection); see the playbook's harness-based verification approach instead