fix: keep orchestration alive through retry guardrails

[numnx]

What changed

• classify Codex failures from structured error events and stderr without treating ordinary agent/tool output as authentication, quota, or rate-limit evidence
• return the classified provider diagnostic to downstream task, QA, and CI workflows instead of benign stderr noise
• retry sprint-completion QA provider failures until the configured review guardrail is reached
• keep sprint runs alive while task/QA human handoffs remain active
• preserve active main-merge CI-fix work by recording and matching explicit source/target branches
• add classifier, QA-budget, provider-execution, and CI DAG/watch-loop regression coverage
• synchronize canonical and published orchestration documentation

Root cause

Codex JSON output was scanned as one untyped error string, so repository fixtures and tool output could match authentication or rate-limit patterns. Sprint QA treated any terminal provider failure as immediately human-owned even below its retry cap. Main-merge CI-fix attention also encoded its source branch in a field the attention scope matcher interpreted as the target branch, so the worker item opened in the same cycle was invisible to the pause decision. Finally, QA exhaustion was classified as no further action even while its human handoff was active.

Impact

Transient or misclassified provider errors retry automatically until guardrails are exhausted. Worker-owned CI repair and guardrail handoffs remain observable by a live sprint instead of requiring an unrelated manual resume.

Validation

• pnpm run ci
• pnpm run check:docs-web
• focused classifier, provider execution, QA, virtual worker, and watch-loop suites

Local CI passed with 5,132 backend tests and 2,007 dashboard tests.

Risk and rollback

Risk is limited to provider failure diagnostics and sprint terminal-state decisions. Roll back this commit to restore the prior classification, QA handoff, and pause behavior.