Guide Email Routing lane retries

[rogu3bear]

Behavioral changes

• Adds cfctl failure guidance for Email Routing and other zone-scoped apply failures when permission probing reports zone_resolution_failed.
• Emits an actionable recommended_lane, next_step, and rerunnable --plan command when another lane can resolve the zone.
• Wires apply backend failures through the shared guidance builder so mutation-script failures are not dead-end execution_failed envelopes.
• Adds static contract coverage for email.routing_rule upsert guidance using a synthetic dev/global lane comparison.

Why

Maildesk provisioning preview showed dev-lane Email Routing plans failing because the dev token could not resolve the zone, while the same plan-only operation succeeded with CF_TOKEN_LANE=global. cfctl had enough lane context to guide the operator but returned null guidance in the apply failure envelope.

Proof

• ./scripts/verify_static_contract.sh passed
• ./scripts/verify_maildesk_cf_contract.sh passed
• python3 scripts/verify_permission_catalog.py --cfctl ./cfctl passed
• git diff --check passed
• Plan-only readback: dev-lane email.routing_rule upsert --plan now returns basis=zone_resolution_failed, recommended_lane=global, and a global-lane --plan retry command

Implications and risk

• No Cloudflare mutation is introduced; this changes error guidance only.
• Preview and ack gates stay intact. The recommended command remains plan-only.
• Main risk is over-recommending a lane if lane comparison is stale or a zone selector is genuinely wrong; the next step text keeps selector correction explicit.

Confidence

• Guidance shape: high, covered by static contract and live plan-only readback.
• Maildesk surface compatibility: high, covered by maildesk contract.
• Runtime safety: high, no apply path bypass or gate weakening.

Next steps

• Review command wording and lane recommendation semantics.
• After merge, rerun the maildesk plan lane so blocked storage/sender-domain operations remain separated from actionable Email Routing previews.

[rogu3bear]

@codex Please review the lane-guidance semantics in this PR, especially whether zone_resolution_failed should always prefer a lane-resolvable plan retry before selector correction, and whether the emitted retry command remains appropriately plan-only for Email Routing apply failures.

[rogu3bear]

Local proof for this PR is green; GitHub static contract did not execute code. The check run has no runner/steps and its only annotation is: "The job was not started because your account is locked due to a billing issue."

Proof run locally on 2026-06-30:

• ./scripts/verify_static_contract.sh passed
• ./scripts/verify_maildesk_cf_contract.sh passed
• python3 scripts/verify_permission_catalog.py --cfctl ./cfctl passed
• git diff --check passed
• Plan-only dev-lane Email Routing readback now emits basis=zone_resolution_failed, recommended_lane=global, and a CF_TOKEN_LANE=global ... --plan retry command

No Cloudflare mutation was performed.