gplay recovery (incident response for a bad release)

gplay recovery manages app recovery actions, Google's targeted incident-response remediation. When a shipped versionCode turns out to be bad, a recovery force-updates the impacted users to a safe version via a remote in-app update. Shared conventions (auth, output, exit codes, --dry-run/--confirm, --package pinning) are in gplay-cli-usage. The whole namespace is [experimental].

Two structural facts to hold onto:

• Keyed by package + versionCode, and it lives outside the Edit model (no editId), a recovery has its own appRecoveryId and a draft → active → canceled lifecycle.
• --version-code is the bad version, the one users are stuck on that you want them off.

The lifecycle, in order