Restore defaults for corrupt chat preferences

[Copilot]

Retrying cannot repair a preference file with invalid content, while resetting on transient or access failures risks overwriting valid settings. This change adds explicit recovery for confirmed corruption and preserves non-destructive retry behavior for other failures.

• Recovery flow: Show a localized Restore defaults action with a notice that saved chat settings and input history will be reset. No confirmation dialog is added.
• Durable file replacement: Run recovery off the SWT thread; back up the exact corrupt bytes to a unique sibling file, recheck that the preference file has not changed, then atomically replace it with serialized defaults. Publish READY only after persistence succeeds.
• Failure and lifecycle safety: Keep backup/write failures actionable without claiming success. Guard recovery by account and generation, coalesce duplicate requests, and re-evaluate changed files rather than overwriting newer choices.
• Independent behavior: Preserve mode-discovery retry and existing model, policy, and confirmation gates. Reuse the existing error logger/telemetry pipeline.

invalid preference content → Restore defaults → backup → durable defaults → READY
transient, path, or access failure → Retry