DRU-614 -- Park unverified work for bounded operator intervention

[kakshilshah]

What changed

Failed or blocked work could reach approval without passing verification. Blocked work and failures that exhaust automatic repair rounds now park for operator intervention, with the PR kept in draft.

The operator can add a note and authorize one Repair or Recheck. Both return through evaluation, another non-passing result parks again. Only PASS proceeds to approval. Recheck rejects a changed PR head, and GitHub reviews cannot bypass intervention.

Public documentation and the changelog are updated. If we dont need to do this, please comment on this PR.

Verification and tests

• 392 backend and 53 frontend tests passed.
• Lint, formatting and frontend build passed.
• Regression coverage includes blocked/failed work, bounded operator actions, changed PR heads, draft-transition failures and workflow recovery.
• Live E2E passed at d87119e: BLOCKED → intervention → PASS → approval → merge. Subsequent review refinements were tested locally.