Harden same-name hoster recovery

Serialize recovery windows per hoster account and normalized filename, reserve remote codes across the batch, and keep cancellation responsive while waiting. Reject semantic and malformed file-list baselines instead of treating them as empty accounts, with focused regression coverage and release allowlist updates.

scripts/verify-public-release.mjs

@@ -116,6 +116,7 @@ const sourceFiles = [
   'tests/history-retention.test.js',
   'tests/hosters.test.js',
   'tests/hoster-recovery-provenance.test.js',
+  'tests/hoster-recovery-safety.test.js',
   'tests/i18n.test.js',
   'tests/ip-allowlist.test.js',
   'tests/log-mode.test.js',
@@ -158,6 +159,7 @@ const sourceFiles = [
   'tests/upload-confirmation.test.js',
   'tests/upload-diagnostics.test.js',
   'tests/upload-manager.test.js',
+  'tests/upload-manager-recovery-claims.test.js',
   'tests/upload-recovery.test.js',
   'tests/upload-start-reservation.test.js',
   'tests/session-report.test.js',