fix(engine): retry transport drops and report shared capacity

[federicodeponte]

Summary

• classify escaped HTTP/2 and socket disconnects as transient_network_error while leaving unknown exceptions as non-retryable crashes
• persist bounded delayed retries with atomic due-time claims, clear exhaustion codes, restart deduplication, and repository failure reporting
• distinguish shared model capacity failures from per-user quota failures and apply a small number of 30 to 60 minute retries
• render human messages for all new active and exhausted error codes in the API and engine web app

Safety properties

• outer transport retry is limited to exceptions raised while driver.run is active
• exceptions before driver entry, after driver return, and during execution-context exit are not retried
• exact manifest retry configuration cannot re-enable exhausted retry codes
• restart recovery detects an existing retry child before creating another
• unknown exceptions remain run_execution_exception and retain crash classification

Verification

• 68 focused backend tests passed across retry policy, transport classification, restart recovery, SQLite queue claims, provider classification, and public error rendering
• Ruff passed on all changed Python files
• Python compile checks passed on all changed engine modules
• full engine web test suite passed with 994 tests and 1 skip
• engine web lint passed with no errors
• engine web production build and TypeScript validation passed
• web copy em dash lint passed
• git diff --check passed

Independent review

Two adversarial review rounds traced all retry callers and restart paths. The review found and prompted fixes for post-driver duplicate side-effect risk, restart-loss of delayed retries, retry-child duplication during a crash window, and false success reporting on repository insert failure. Focused regression tests cover each correction.

Related concurrency follow-up: #2279