ci: verify clean RC2 group recovery fixes

[zsumz]

Temporary focused hosted verification; do not merge this workflow and do not count it as full release qualification. Both instrumented diagnostic runs are archived: 33957819158 reproduced retained-partition Fetch starvation, and 33958439538 reproduced RouteUnavailable followed by fatal CoordinatorUnavailable twice. This workflow now checks clean native candidate c93e2094de4d70d3af9e8f7cc8bd99d5f7904fee without instrumentation or dirty-candidate permission. It repeats the three unchanged consumer membership, classic recovery, and consumer-protocol recovery scenarios three times each on SASL/PLAIN and TLS in two parallel jobs. Production Testlab source and native immutable pin remain unchanged. No local builds or tests.

[zsumz]

Temporary diagnostics are complete and removed. Both control 7e54c80c and fixed candidate 192ed9c1 passed all six unchanged broker-recovery attempts in run 33950979758; their separate artifacts remain archived. No diagnostic instrumentation or reduced pack was merged into Testlab production. The earlier intermittent Execution failure was not reproduced by this control, so this is not claimed as causal proof. Candidate code CI, clean PR qualification, and the complete final-commit release matrix remain the release authority.