refactor(operator-trend): collapse refresh-recovery builders onto a parametrized base (T3-2 phase 6d) (#85)

Fourth and final clean rebuild<->rererestore family. The two refresh-recovery
builders (~250 lines each) share one algorithm differing only in the per-event
reset/freshness keys, the recovery + next-tier restore status tokens, their reason
prose, and output keys. Extract _recovery_for_target_base + a _RecoveryTierSpec
(22 tier fields); both public builders become thin wrappers.

This one earned a stronger proof than the others. Its branch coverage is too wide
for a corpus differential alone, so correctness is established by STRUCTURAL
AST-equivalence: the base with each tier's spec substituted back in is AST-identical
to the original function -> byte-identical for the entire input space, not just
corpus-exercised paths. (Plus the composer golden is byte-identical to main and the
full suite passes.)

Public signatures unchanged. Net -156 lines.

Verified: structural AST-equivalence (both tiers) + composer golden byte-identical
+ full suite (2539 passed). ruff + mypy clean.

Author: saagpatel