fix(sandbox): auto-retry transient claim failures before showing errored

[pedrofrxncx]

Follow-up to #5207 (merged). That PR stopped the infinite spinner by surfacing a terminal claim failed phase as the errored card + Retry. This PR adds bounded auto-recovery so transient infra failures self-heal without a manual click.

Why

#5207 requires a manual Retry for every terminal claim failure, including ones that are just transient infra hiccups (a node had no capacity for a moment, a control-plane blip). Those should self-heal.

What

On a terminal claim failed phase, auto-reprovision in place for the reasons a fresh claim can plausibly resolve, bounded to MAX_CLAIM_AUTO_RETRIES (2 → 3 total attempts), then fall through to the errored card.

ClaimFailureReason	Auto-retry?	Rationale
scheduling-timeout	✅	no capacity — Karpenter may have added a node
reconciler-error	✅	transient control-plane hiccup
claim-never-created	✅	the claim write was lost — re-issue it
unknown (synthetic "watcher ended")	✅	the watch died, not necessarily the boot
image-pull-backoff	❌	bad/missing image — fails identically
crash-loop-backoff	❌	the container's own code crashes on start

While auto-retry budget remains, deriveStartError returns null (claimRetryExhausted=false) so the booting overlay holds instead of flashing errored between attempts.

Correctness details

• Fires once per failed episode: a claimFailureHandledRef guard is set when a retry fires and re-armed only when the phase leaves failed, so the persistent failed phase can't re-fire every render once the mutation settles.
• Bounded budget per boot via claimRetryCountRef; a user-driven retry() resets both refs for a fresh budget.
• Same gates as auto-start / self-heal: userStopped, autoStartBlocked (others' thread), and isPending all suppress it.
• Reuses useSandboxStart's module-level inflight dedup, so even a double-fire coalesces to one upstream SANDBOX_START.

Tests

Pure helpers isRetryableClaimFailure + shouldAutoRetryClaim unit-tested (retryable vs non-retryable reasons; budget exhausted; already-handled; pending / stopped / gated). Existing deriveStartError tests updated for the new claimRetryExhausted arg + a new keep-booting case. bun test 55 pass · tsc clean · lint 0 errors · fmt clean.

---

Summary by cubic

Automatically retries transient claim failures during sandbox boot before showing the errored card. This self-heals common infra hiccups and reduces user clicks and flicker.

• Bug Fixes
  • Auto-retries in place for retryable failures: scheduling timeout, reconciler error, claim never created, and watcher ended; capped at 2 auto-retries (3 total attempts).
  • Non-retryable failures (image pull backoff, crash loop backoff) surface the error immediately.
  • Keeps the booting overlay while retry budget remains; updated start error derivation to respect retry exhaustion.
  • Fires once per failed episode, honors userStopped and others-thread gates, dedups inflight starts, and resets budget on user Retry; added unit tests for retry logic.

^{Written for commit 418e4fe. Summary will update on new commits.}