[Critical] Enable classifier by default for unknown resources

[jessfortemnaturae8717]

Problem

The decision tree classifier exists but is opt-in only. Unknown resources fall back to a weak default handler.

Current behavior:

// src/analyzer/blast-radius.ts
const getRecoverabilityFn = useClassifier  // Defaults to false!
  ? (change, state) => getRecoverabilityDual(change, state)
  : getRecoverability;

Default handler for unknown resources:

// src/resources/index.ts
const defaultHandler = {
  getRecoverability(change) {
    if (!change.actions.includes('delete')) {
      return { tier: REVERSIBLE };  // Too permissive!
    }
    return { tier: RECOVERABLE_WITH_EFFORT };
  }
};

Risk

• Non-delete actions on unknown resources auto-pass as REVERSIBLE
• The trained classifier (which is more conservative) is never invoked
• Users don't know they should enable it

Solution

1. Enable classifier by default
2. Run dual-verdict mode: deterministic rules + classifier must agree
3. Escalate to NEEDS_REVIEW when they disagree

Tasks

• Change useClassifier default from false to true
• Update default handler to be more conservative for unknown types
• Add disagreement detection between rules and classifier
• Log/report when classifier overrides default handler
• Update CLI help to document classifier behavior
• Add integration tests for unknown resource handling

Acceptance Criteria

• Unknown resource types trigger classifier automatically
• Classifier + default handler disagreement → NEEDS_REVIEW
• No performance regression (classifier adds < 10ms)

---

Priority: P0 — Must fix before monetization