QUEUED-tier commands that must still run when startup has failed.
When the configured model can't be built (e.g. its provider package is
missing) the server never starts and the app holds a _server_startup_error
state that parks queued messages. These are the recovery escape hatches for
that state — install the missing package, reload config/env, or upgrade the
tool — so they must bypass the queue rather than sit behind the very failure
they repair. /model and /auth already escape via IMMEDIATE_UI (which
opens a modal and defers the real work); the commands here instead perform
their repair work directly, so they stay QUEUED and rely on this exemption.
The bypass itself is gated in _can_bypass_queue. Every entry is also
QUEUE_BOUND — the recovery exemption is orthogonal to the normal queue.
