fix(#5379,#5380,#5381,#5382): recovery re-dispatch, honest deployment modes, fail-closed security gate, connector generation fencing (#5385)

#5379: ReliableDispatcher.recover() no longer advances the subscriber offset as if
the absent client had ACKed (a skip across the crash window). Recovery now
RE-DISPATCHES each persisted in-flight record through a buffered poll channel with
its attempt counter preserved; the offset advances exactly once - when the client
actually ACKs. Legacy undecodable records retire without any offset advance. The
old retire semantics stays as a @Deprecated private method for source compat.
DeliveryRecoveryTest / CrossStoreFaultInjectionTest scenario 1/1b are updated to
the re-dispatch contract; new RecoveryRedispatchTest covers the crash->re-dispatch->
ACK-exactly-once shape.

#5380: docs/eventmesh-features.md gains "5b. Deployment modes" (core Runtime /
session-streaming Runtime / A2A Gateway) so capability claims match what the
default bootstrap actually starts; docker/Dockerfile note hardened accordingly.

#5381: EventMeshApplication.main() wires a config-backed SecurityGate
(eventmesh.security.profile, default "production"; eventmesh.security.tokens) via
withSecurityGate(gate) and installs it into the traffic httpServer; production
profile with empty token filters fails closed with IllegalStateException.

#5382: ConnectorScheduler bumps a per-connector fencing generation on every
(re)assignment or def change and splices "generation" into the /control/start
envelope; ConnectorManager.startConnector accepts a start iff gen >= running gen
(stale delayed starts are rejected and logged), rebuilds on newer generation, and
stopConnector clears the running generation. ConnectorDef (both runtime and
connector-runtime sides) carries the generation field; new
ConnectorGenerationFencingTest covers accept/reject/idempotent-re-push.

Local verification: :eventmesh-runtime:test :eventmesh-connector-runtime:test
:eventmesh-architecture-guard:test + checkstyleMain/Test for both modules - all green.