fix: rebuild recovery write, picker, and delete stderr

[wcgomes]

Summary

• Recovery helper write chowns the stamped in-volume devcontainer.json to the parent-directory owner and chmod 644, so the connection user can edit it (no more EACCES). Host session stays 0700/0600; not world-writable.
• Volume/named recovery retry pins the already-selected container (--name / selectedOverride) and does not re-open the interactive picker.
• Retryable Apple stale-exec deleteProcess: exec … does not exist stderr is captured for classification, not live-teed under ==> Deleting container. The diagnostic is shown only on fail-closed.

Test plan

• Recovery write script asserts parent-dir chown + 644
• Rebuild phase tests: volume/named retry does not re-open the picker
• Delete/stop retry path does not live-tee Apple stderr (streamStderr: false)