Return a manual recovery command, never raising.
Wraps install_extra_recovery_command so recovery-hint call sites never
let a second failure (validation, uv-receipt introspection, or unexpected
metadata errors) replace the original install/user error. On any failure
it logs and returns fallback so the hint is never empty.
