feat: ADR-0034 — history journal records err + replay parses/filters the journal

Replay (§3): run_replay parses <ts>|<status>|<source> journal records — runs ok, skips non-ok — while still accepting bare .commands scripts (prefix-detected so a | inside a bare command isn't misread). Fixes replay history.log, which died on line 1.

Journal failures (§1/§2): failed commands are recorded err via a new Action::JournalFailure, emitted by the pure-sync App for both parse failures and worker-execution failures (runtime appends best-effort, never fatal). Hydration reads all records so typo'd/rejected commands are recallable across sessions.

Amendment 1 — replay filters app-lifecycle commands: a working replay history.log exposed that the journal also records save as/load/new/export/import/rebuild/mode (which would panic the worker dispatch or abort replay). Replay now re-applies only schema/data writes and skips every app-lifecycle command + nested replay, classified by entry word so modal/incomplete forms (save as, bare mode) and quit skip uniformly rather than aborting. All skips continue (reversing the nested-replay refusal); import and nested replay warn. replay.error_nested removed; replay.skipped_import/_replay added; ReplayCompleted carries warnings. requirements.md U3/U4 updated; app-command runtime-failure journalling tracked as a follow-up.

1659 passing / 0 failing / 0 skipped / 1 ignored. Clippy clean.

docs/plans/20260524-adr-0034-history-journal.md

@@ -246,6 +246,22 @@ Push is the user's step.
    available at the err-append site (it is for recall today;
    verify for the journal).
 
+## Implementation outcome (2026-05-24)
+
+Both sub-tasks landed test-first as planned. A **third concern surfaced
+during implementation** and was resolved with the user, becoming
+**ADR-0034 Amendment 1**: making `replay history.log` work (Sub-task 2)
+exposed that the journal also records app-lifecycle commands
+(`save as` / `load` / `new` / `export` / `import` / `rebuild` / `mode`),
+which would panic the worker dispatch or abort replay. Replay now
+**skips** every app-lifecycle command + nested `replay` (re-applying
+only schema/data writes); all skips continue (the prior nested-`replay`
+refusal is reversed), with a `[skip]` warning on `import` / nested
+`replay`. Classification is by entry word so the modal / incomplete
+forms skip uniformly rather than aborting. See the amendment in
+`docs/adr/0034-…` and `tests/replay_command.rs`. `requirements.md`
+U3 / U4 updated to match.
+
 ## What this plan does NOT contain
 
 - Time estimates (milestones, not hours).