refactor(runner): shim-owned retry policy (closes PR #87 no_output bypass + moonshot gap)

[chorus-codes]

Follow-up to the PR #87 chorus self-audit (6 request-changes / 2 approves).

What the audit caught

1. THE BUG (antigravity + gemini, HIGH severity): the COMMON opencode-go failure mode is empty-stdout exit with `eventCount === 0`. The runner's finally block synthesises `kind: 'no_output'` for that case, and `no_output` is universally terminal — so the new opencode-null retry was unreachable for the bug PR feat(runner): one-shot retry on opencode null-with-no-errorKind #87 was shipped to fix. The retry only helped the rare case where opencode emits some events but no usable content.

2. Slippery slope (every reviewer): a lineage exception in the central classifier is a one-off escape valve that grows. Moonshot (also opencode-go) was an unprotected gap (codex flagged via the `isOpenCodeFamily` idiom used throughout error-detector.ts).

Fix

Move retry-on-null-kind and retry-on-no-output out of the central classifier and into the shim layer. Each `AgentShim` declares its own `retryPolicy`:

```ts
readonly retryPolicy?: {
readonly extraKinds?: readonly string[];
readonly onNullKind?: boolean;
readonly onNoOutput?: boolean;
};
```

• opencode shim: opts into both flags (closes the no_output bypass — THE bug)
• kimi shim (moonshot lineage): same opts-in (closes the moonshot gap)
• codex/claude/gemini/grok/antigravity/openrouter shims: unchanged — universal transient list as before

`isRetryableErrorKind` signature changes from `(kind, lineage?)` to `(kind, shim?)`. Universal terminal kinds (`quota_exhausted`, `token_refresh_lost`, `opencode_db_corrupt`) still beat shim opt-ins — explicit terminal kinds cannot be overridden.

Tests

978 → 982 passing. Test stubs use `Pick<AgentShim, 'retryPolicy'>` instead of lineage strings — matches production call shape.

Out of scope (audit follow-ups for a separate PR)

• Telemetry: record retry-succeeded rows so the policy's effectiveness is measurable. Universal across reviewers.
• Verdict-parse-failure false positive (codex finding Unable to use OpenCode #5): opencode-cli-7 traced this carefully and found non-empty content always returns a real verdict, so apology-shaped responses don't reach the retry path. Closed as non-issue.

Test plan

• `pnpm typecheck` clean
• `pnpm test` 982/982 passing
• Chorus self-audit (recursive: audit the audit-followup)