Recovery ladder

Three levels of undo: reject change inline, /rewind to session checkpoint, `git restore` as nuclear reset.