Prism roles: single model lists, Retry and Escalation switches (#127); release 0.37.0

[lukemaj]

Closes #127: only the Worker keeps easy/medium/hard lanes; Dispatcher, Reviewer, Retry and Escalation each read one model list, and Retry and Escalation can be switched off in Prism.

Elon method record

• Wanted result: the runner honors the fork's new snapshot shape (feat(web): Prism settings in the Providers layout, lanes only for Worker chromeria#35): one models list per non-worker role and enabled on correction/recovery, with user-facing text saying Retry and Escalation.
• Evidence: the fork contract (packages/contracts/src/prismSnapshot.ts) still repeats each single list in every lane, so old and new snapshots both carry what the runner needs.
• Cuts: no rename of internal keys, stage names, events (recovery_decision, recovery_exhausted) or controller state, which keeps the snapshot contract and stored jobs stable. No new ladder state: switched-off rungs just drop out of the rung order, so failure counting is unchanged. No CLI change: its only "recover" already means controller recovery.
• Smallest surviving solution: models preferred in stage_preferences with the lane fallback, t3snapshot.ladder_enabled() from the last applied snapshot, and _apply_ladder indexing failures into the enabled rungs.

Acceptance criteria

1. runner/t3snapshot.py reads roles.<role>.models for dispatcher, reviewer, correction (Retry) and recovery (Escalation); the worker keeps three lanes. A snapshot without models uses the role's entry for the job's lane. An empty models keeps the policy order, as an empty lane list did before.
2. enabled: false on Retry drops the retry and fresh-retry rungs; on Escalation it drops the escalation rung. With both off, the first failure goes to the planner question, and the planner's one authorized attempt still ends the job as escalation_exhausted if it fails. The exhaustion message lists only the rungs that are on. capacity shows ladder_enabled.
3. GLOSSARY adds Retry, Escalation and Recovery (controller recovery only) and says the internal keys stay correction/recovery. Policy stage notes and RUNNER.md use the new names. CLI help needed no change.
4. tests/test_issue127.py: reads the models list, falls back to old lanes, keeps the policy order for an empty list, defaults the flags on, and covers Retry off, Escalation off and both off.

Mid-job switches (review follow-up)

Each new failure takes the next enabled rung after the last rung this job used (rung_at/ran in the ladder phase; jobs laddered before this infer both from the last rung). Escalation is never chosen again once escalated is set, and the exhaustion message lists the rungs that actually ran. Tests: Retry switched off after two failures still escalates; Retry switched back on after an escalation asks the planner instead of escalating twice; a rung is taken once per failure.

Proof (head ac61e18)

• python3 -m unittest discover -s tests: 302 tests OK
• python3 -m compileall -q runner scripts tests: OK
• python3 -m runner.policy validate: rc 0
• versionctl release-check: release candidate OK, v0.37.0

Not merged; a person merges it.

🤖 Generated with Claude Code