feat: add stall-recovery cold-start fallback for automated op recovery (#330)

**Key Changes:**

- Implemented a new cold-start fallback for automated stall recovery
when no
  users or credentials have been discovered but DCs are known
- Added deduplication logic for cold-start tasks across recovery
attempts
- Enhanced logging and dispatch tracking for stall recovery operations

**Added:**

- Cold-start deduplication key and selection logic to build unique keys
per
domain and recovery attempt, ensuring idempotent dispatch of fallback
tasks
- `select_stall_cold_start_work` function to select eligible cold-start
work
  items when the op is stalled with known DCs but no users/creds
- New fallback branch in `auto_stall_detection` to submit AS-REP
roast-based
user enumeration when previous strategies yield no results, gated by the
  `asrep_roast` strategy allowlist
- Unit tests for cold-start dedup key construction, work selection
logic, and
  deduplication across attempts

**Changed:**

- Enhanced the stall detection logic to track and log the number of
fallback
  tasks dispatched per recovery attempt, improving observability
- Updated deduplication constant lists and test coverage in state
management
  modules to include the new `stall_cold_start` dedup set

Author: l50