v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

R-216: the offsite key recovery is a coupled feature and now says so. featureProbes +
featureMinAgent 0.125.0 + a Supports gate at the unlock entry point, FAILING CLOSED — an
agent that cannot answer is named as such instead of the customer's code being blamed.
Measured live: a 404 from agent 0.120.0 came back as "we did not accept your recovery
code, check that all ten words", in 0.134 s, against a perfect code.

R-218: delete the repo-password short-circuit in needsOffsiteCredential. The declaration
stops when the TIER WORKS, not when a key exists — installing a key is the recovery
screen's whole job, so succeeding at recovery was switching off the mechanism that would
have delivered the coordinates to use it.

R-219: the unlock finishes the job — place the key, bring the tier up, then list. Without
it the promised listing could never render on the shape the screen exists for.

R-217: an unreadable store no longer claims to have opened with unattributable content
(the OffsiteInventory{} zero value). Opened / empty / unreadable are three states.

R-222: a code that is right about a RETAINED earlier package is named, not blamed. States
what the hub knows and promises nothing — no read path exists.

R-215: GET /recovery is gated on the same predicate as the interception.

Five red-proofs, each demonstrated failing and restored.

controller/internal/web/server.go

@@ -104,6 +104,13 @@ type Server struct {
 	// recoveryRecovererFn is the recovery screen's agent seam (nil → the shared agentClient(), the
 	// same channel the CLI uses). Tests inject a fake so the HANDLER itself can be driven.
 	recoveryRecovererFn func() (backup.OffsiteKeyRecoverer, error)
+	// recoverySupportFn overrides the R-216 agent-capability verdict for the unlock path (tests).
+	// nil → the real gate over netFeatures. See recoverySupport: Unknown means CANNOT ASK here.
+	recoverySupportFn func(context.Context) agentapi.SupportState
+	// recoveryTierUp brings the off-site tier up between placing a recovered key and reading the
+	// repository (R-219). Wired from main.go to the apply-bridge's Reconcile; nil → skipped, and the
+	// listing branch then reports what is pending rather than claiming a failure.
+	recoveryTierUp func(context.Context) error
 
 	// NAS add orchestration (verify-before-commit): the single-flight job slot + the two seams.
 	// netAgentFn nil → the shared agentClient(); netProbeFn nil → runNetProbe (the uid-1000 re-exec).