Runner cutover: DELETE escalate from the data-integrity runner → autonomous applyHeal (interim actuator + orchestrator wiring)

Context — child of #14132

#14132 (operator directive: DELETE escalate, 100% autonomous self-heal, no runtime operator) requires the data-integrity RUNNER path to stop routing to escalateDiagnosis and route every diagnosis to an autonomous heal terminal. The original runner (#14109, CLOSED) built the detect-producer scheduling with the escalate terminal; this leaf is the integration cutover that re-shapes that terminal to autonomous self-heal.

This is the runner-path slice of #14132. The actual heal OPERATIONS, the producer raw-evidence re-route, and the ADR amendments are sibling children (see Out of scope) — this leaf makes escalate structurally dead in the runner and routes everything to the autonomous actuator.

Scope — fully delivered by the PR

• Mode-classifier (dataIntegrityModeClassifier) — corruption-mode taxonomy → autonomous terminal actions; single source for mode→action. Zero escalate.
• Runner re-shape (DataIntegrityDiagnosisService) — escalateDiagnosis() DELETED; gatherAndDiagnose() → evidence-gatherer → classify → applyHeals() → recoveryActuator.applyHeal. The runner reaches applyHeal ONLY (invariant spec); a failing probe → probe-unavailable, heals nothing (a failed probe is never a corruption signal).
• Evidence-assembler (dataIntegrityEvidenceAssembler) — folds the detect-producers' diagnoses → per-collection classifier-input rows.
• Interim actuator (DataRecoveryActuatorService) — applyHeal wraps the pure dispatchHeal safety core (rate-limit + anti-thrash). INTERIM: no heal operations wired → every cleared action resolves to deferred (autonomous, recorded, never a page) — strictly better than the deleted escalate, which paged into an operatorless void. The real ops extend the seam in #14134 / #14133 without touching the applyHeal({action, collection, evidence, now}) contract (healOps + recentRunsReader + recordRun injected together, per the #14134 fail-closed invariant).
• Orchestrator wiring — the actuator + the coverage-backed evidence-gatherer are injected into the runner; the dataRecoveryActuatorService_ config-slot / beforeSet hook pairing holds the Orchestrator reactive-config invariant. Classification precision (collectionSizes / documentsPresentByCollection) wires with the ops in #14134 — precision only changes the OUTCOME once a heal acts, and the interim all-defers, so coverage → assemble → classify → defer is correct-by-construction.
• Pipeline status-mapping — healed / clean → completed.

Out of scope — sibling children of #14132

• Real heal OPERATIONS (re-embed / restore-delta-merge / defrag) — #14134 (Grace).
• quarantine-from-serving safe-default op — #14133.
• Re-route the 5 producers to raw-evidence — #14138 (Ada).
• Orchestrator live-Chroma dimension gatherer + dimension-producer runner-seam — #14130 / #14129.
• ADR-0025 / 0026 amendment, container-health producers, #14131 — on #14132 directly.

Acceptance Criteria

• escalateDiagnosis() deleted from the data-integrity runner; the runner routes every actionable classification to recoveryActuator.applyHeal and nowhere else (invariant spec asserts no escalate/operator sink).
• The interim actuator resolves every action to a recorded outcome (deferred until ops wire), never an escalate/page status.
• The orchestrator injects the actuator + evidence-gatherer; the reactive-config slot/hook invariant holds.
• All affected specs green — classifier, runner, assembler, actuator, orchestrator construction + invariants.

Test Evidence

Affected specs (run green pre-PR): dataIntegrityModeClassifier.spec, DataIntegrityDiagnosisService.spec (incl. the no-escalate-sink invariant), dataIntegrityEvidenceAssembler.spec, DataRecoveryActuatorService.spec, Orchestrator.spec + Orchestrator.invariants.spec (the config slot/hook + fail-loud-read invariants).

Authored by Vega (Claude Opus 4.8, Claude Code). Origin session 1bb8a27b-ae0d-4668-a9a2-acbbe2387512.