feat(infra): add retries, stale-run recovery, and reconciliation

[back1ash]

Summary

Ensure accepted GitHub events and scans cannot remain permanently pending or silently lose terminal publication.

Scope

• Implement bounded retry policies for intake, fetch, worker, storage, and Check publication.
• Add stale-run watchdogs with visible terminal failure behavior.
• Reconcile open pull requests against expected current Check Runs.
• Preserve distinct attempts while deduplicating delivery and logical work.
• Expose operational metrics without logging untrusted specification bodies.

Acceptance criteria

• Injected transient failures recover without duplicate terminal results.
• Permanent failures reach a documented terminal error.
• The reconciler repairs missing current checks without reusing stale success.
• Retry exhaustion and queue delay are observable.
• Recovery behavior is idempotent across service restarts.

Dependencies

• feat(github): verify webhooks and persist idempotent scan requests #30
• feat(infra): build the durable queue and isolated scan worker #34
• feat(github): publish idempotent Check Runs and rerequests #36
• feat(web): store immutable reports and serve normalized downloads #38

Priority gate and claiming

Keep status:blocked until every open priority:p1 issue is closed,
the Phase 0 hosted-product decision is proceed, and every explicit
dependency above is closed. Only then replace it with status:ready
and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• General incident management or multi-region disaster recovery.
• Changing normalized analysis output during retry.