feat: per-agent retry policies

[Copilot]

Adds declarative per-agent retry configuration so transient provider failures don't kill entire workflows. Previously the only recovery was checkpoint/resume.

Schema

New RetryPolicy model on AgentDef.retry:

agents:
  - name: analyzer
    model: gpt-5.2
    retry:
      max_attempts: 3        # 1-10, default 1 (no retry)
      backoff: exponential    # or "fixed"
      delay_seconds: 2        # base delay, 0-300
      retry_on:
        - provider_error      # API 500s, rate limits
        - timeout             # agent-level timeouts

Validation errors (schema mismatches) are never retried. Script agents cannot have retry.

Provider changes (copilot.py, claude.py — parity maintained)

• _resolve_retry_config(agent) — merges agent-level RetryPolicy into provider-level RetryConfig, falls back to provider default when unset
• _classify_error(error) — categorizes exceptions as "provider_error" or "timeout" (checks exception type, status code 408, message content)
• _calculate_delay — now supports "fixed" backoff in addition to exponential
• _execute_with_retry — checks retry_on filter, emits agent_retry events via event_callback

Tests

35 new tests covering schema validation, _resolve_retry_config, fixed/exponential backoff, retry_on filtering, agent_retry event emission, and error classification.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/copilot_internal/user
  • Triggering command: /home/REDACTED/work/conductor/conductor/.venv/lib/python3.12/site-packages/copilot/bin/copilot /home/REDACTED/work/conductor/conductor/.venv/lib/python3.12/site-packages/copilot/bin/copilot --headless --no-auto-update --log-level info --stdio (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)