feat: ADR-0034 — history journal records err + replay parses/filters the journal

Replay (§3): run_replay parses <ts>|<status>|<source> journal records — runs ok, skips non-ok — while still accepting bare .commands scripts (prefix-detected so a | inside a bare command isn't misread). Fixes replay history.log, which died on line 1.

Journal failures (§1/§2): failed commands are recorded err via a new Action::JournalFailure, emitted by the pure-sync App for both parse failures and worker-execution failures (runtime appends best-effort, never fatal). Hydration reads all records so typo'd/rejected commands are recallable across sessions.

Amendment 1 — replay filters app-lifecycle commands: a working replay history.log exposed that the journal also records save as/load/new/export/import/rebuild/mode (which would panic the worker dispatch or abort replay). Replay now re-applies only schema/data writes and skips every app-lifecycle command + nested replay, classified by entry word so modal/incomplete forms (save as, bare mode) and quit skip uniformly rather than aborting. All skips continue (reversing the nested-replay refusal); import and nested replay warn. replay.error_nested removed; replay.skipped_import/_replay added; ReplayCompleted carries warnings. requirements.md U3/U4 updated; app-command runtime-failure journalling tracked as a follow-up.

1659 passing / 0 failing / 0 skipped / 1 ignored. Clippy clean.

docs/requirements.md

@@ -370,15 +370,26 @@ handoff-14 cleanup; 449 after B2/C2.)
 - [ ] **U2** `undo` restores the most recent snapshot; `redo`
   re-applies; both prompt for confirmation showing the snapshot
   timestamp and a summary of the changes that will be discarded.
-- [x] **U3** `history.log` records every successfully executed
-  command in append-only form (Iteration 2). Format:
-  `<ISO-8601 Z>|ok|<source>` per ADR-0015 §5.
+- [x] **U3** `history.log` records every submitted command in
+  append-only form, tagged with its outcome (Iteration 2;
+  broadened by ADR-0034). Format: `<ISO-8601 Z>|<status>|<source>`
+  per ADR-0015 §5 / ADR-0034 §1 — `status` is `ok` for a
+  successful command and `err` for one that failed to parse or
+  execute. Hydration (cross-session recall) reads all records;
+  replay reads `ok` only.
 - [x] **U4** `replay` runs commands from a `history.log` or
   `.commands` file. *(Implemented via ADR-0024 Phase E:
   `runtime::run_replay` parses each non-blank, non-`#`-comment
-  line with the schema-aware parser and dispatches it through
-  the normal pipeline; stops at the first error, no rollback;
-  nested replay refused. Covered by `tests/replay_command.rs`.)*
+  line in advanced mode and dispatches it through the normal
+  pipeline; stops at the first genuine error, no rollback.
+  ADR-0034 §3: replay reads journal records (`<ts>|<status>|
+  <source>`), running `ok` records and skipping non-`ok`, while
+  still accepting bare-command scripts. ADR-0034 Amendment 1:
+  replay re-applies only schema/data write commands and **skips**
+  every app-lifecycle command + nested `replay` — all skips
+  continue (a nested `replay` is now skipped, not refused), with a
+  `[skip]` warning on `import` / nested-`replay`. Covered by
+  `tests/replay_command.rs`.)*
 
 ## Sharing and export (per ADR-0007)