v0.201.0 — a correct recovery code is never called wrong again (CAMPAIGN-11) — MinAgent 0.125.0

R-216: the offsite key recovery is a coupled feature and now says so. featureProbes +
featureMinAgent 0.125.0 + a Supports gate at the unlock entry point, FAILING CLOSED — an
agent that cannot answer is named as such instead of the customer's code being blamed.
Measured live: a 404 from agent 0.120.0 came back as "we did not accept your recovery
code, check that all ten words", in 0.134 s, against a perfect code.

R-218: delete the repo-password short-circuit in needsOffsiteCredential. The declaration
stops when the TIER WORKS, not when a key exists — installing a key is the recovery
screen's whole job, so succeeding at recovery was switching off the mechanism that would
have delivered the coordinates to use it.

R-219: the unlock finishes the job — place the key, bring the tier up, then list. Without
it the promised listing could never render on the shape the screen exists for.

R-217: an unreadable store no longer claims to have opened with unattributable content
(the OffsiteInventory{} zero value). Opened / empty / unreadable are three states.

R-222: a code that is right about a RETAINED earlier package is named, not blamed. States
what the hub knows and promises nothing — no read path exists.

R-215: GET /recovery is gated on the same predicate as the interception.

Five red-proofs, each demonstrated failing and restored.

controller/internal/web/templates/recovery.html

@@ -18,7 +18,12 @@
     {{if .Flash}}<div class="alert alert-info">{{.Flash}}</div>{{end}}
     {{if .Error}}<div class="alert alert-error">{{.Error}}</div>{{end}}
 
-    {{if .InvEmpty}}
+    {{if .InvUnavailable}}
+    <!-- R-217: the unlock SUCCEEDED but the repository could not be read. It renders NO listing and
+         claims nothing about the contents — the .Error above already says what is pending. This
+         branch exists because the previous code passed a zero-value OffsiteInventory here, whose
+         Empty=false fell through to .InvUntagged and asserted the store had opened with content. -->
+    {{else if .InvEmpty}}
     <div class="alert alert-warning">
         A tároló megnyílt, de <strong>nincs benne egyetlen mentés sem</strong>. Ez azt jelenti, hogy a
         kulcs jó volt, de ehhez a géphez nem tartozik korábbi mentés. Ha korábban biztosan készültek