feat(automation): add durable runner and signed approval recovery

scripts/Run-JobjaktBacklog.ps1

@@ -0,0 +1,24 @@
+#Requires -Version 7.2
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][ValidateSet('init','validate','dry-run','start','resume','status','pause','retry','current','logs','recover','configure')][string]$Command,
+    [Parameter(Mandatory)][string]$ControlRoot,
+    [string]$Repository,
+    [string]$Stage,
+    [string]$Manifest,
+    [string]$Python = 'python'
+)
+$ErrorActionPreference = 'Stop'
+$root = [IO.Path]::GetFullPath($ControlRoot)
+if ($Command -eq 'init') {
+    $engine = Join-Path $PSScriptRoot '../automation/controller.py'
+} else {
+    $engine = Join-Path $root 'controller.py'
+}
+if (-not (Test-Path -LiteralPath $engine -PathType Leaf)) { throw "Controller missing: $engine" }
+$arguments = @($engine, $Command, '--control-root', $root)
+if ($Repository) { $arguments += @('--repository', $Repository) }
+if ($Stage) { $arguments += @('--stage', $Stage) }
+if ($Manifest) { $arguments += @('--manifest', $Manifest) }
+& $Python @arguments
+exit $LASTEXITCODE