sched: require proven ownership at poll/admin/recovery entries (F5)

src/wf_scheduling/recovery.py

@@ -13,6 +13,8 @@ from __future__ import annotations
 from datetime import datetime, timezone
 from typing import Any
 
+from wf_scheduling.ownership import SchedulerOwnership, SecondOwnerError
+
 UTC = timezone.utc
 
 ABANDONED_REASON = (
@@ -30,11 +32,17 @@ def recover(
     schedule_store: Any,
     run_store: Any,
     now: datetime,
+    ownership: SchedulerOwnership,
     record_history: Any | None = None,
 ) -> list[str]:
     """Reconcile durable state after a restart without executing work."""
     from wf_artifacts.runs.models import StoredRunStatus
 
+    if ownership is None or not ownership.held:
+        raise SecondOwnerError(
+            "scheduler ownership is required before recovery: an unowned "
+            "recovery could abandon or redispatch another owner's work"
+        )
     diags: list[str] = []
     # Admission record is the recovery authority: admitted but never
     # materialized views are completed here and flagged pending for the