fix(analysis): surface recovered tool errors

[drewstone]

What changed

• emit one deterministic finding for recovered tool errors with exact span citations
• retain root and failed-tool evidence on terminal failures without duplicate findings
• cap cited errors at three and report omitted counts
• correct CodeTraceBench clean-control documentation

Proof

• pnpm test: 381 passed
• pnpm typecheck: passed
• pnpm build: passed
• pnpm check:package: package ships the CLI and two skills
• HALO bad fixture: 1 finding citing 3/3 failed calls
• HALO clean fixture: 0 recovered-error findings
• git merge-tree --write-tree origin/main HEAD: clean