fix: Bound tier rebuild OOM recovery

[buildingjoshbetter]

Persistent tier-rebuild OOM could retry the same singleton until the 9000-second timeout while cache cleanup still retained the failed forward's traceback. A failed rollback could also enter nested retries and report completion for uncommitted vectors.

Move recovery outside the exception handler and bound failed paired batches at an unchanged source offset to 2 * (floor(log2(N)) + 1), where N is the first failed actual batch length. The effective retry size cannot grow. Each halving phase gets two failures, including one cleanup retry at singleton size. Progress resets the recovery budget only after the vector pair and checkpoint commit. Cancellation and timeout are rechecked before recovery starts another native batch.

A still-active owned transaction after failure now propagates to the manager for connection closure before retry or status publication. The last stored status may remain running because writing a replacement through that uncertain transaction is unsafe. Clean status rollback remains best-effort; borrowed savepoint behavior is unchanged.

Stacked on #818, which already includes #788's paired-write foundation and the reviewed MCP compatibility correction. This diff contains only the worker change, its new tests and the resource-budget documentation addition. Existing tests, model identities, rerankers, dtype, retrieval policy and successful normal batching are unchanged. Refs #297 and #752.

Validation:

• 14 new tests / 19 subtests pass. Original-worker negative control: 21 assertion failures, zero test errors. Original failing probe preserved: 4 of 5 cases fail; corrected worker passes all 5.
• Independent review: 25 additional recovery, lifetime and transaction cases pass. All 80 original atomicity assertions remain unchanged. Publication mapping and privacy checks pass.
• Author/combined exact source: 3,081 tests / 2,645 subtests; log SHA256 54e4a44a67cf434450f38f54a9188d5b2660d73858f510ab630a1602e6f070ae.
• Publication exact source: 2,849 tests / 1,709 subtests; log SHA256 80739f1d8a42b29d238ea1d6c8fbe0855d3dc5bbc5c60735d3e5461d16265515.
• Both full suites: 17 skips, 3 deselections, actual sqlite-vec enabled, sequential offline unprivileged GPUBox containers, exit 0, no timeout/OOM. Installed-wheel builds, Ruff and Python 3.10 source parsing pass.

This bounds repeated nonprogress and releases the handler's traceback reference before cleanup. It does not bound one native call, allocator bytes or the retained full source list. Original Mac memory use, MPS calibration and whole-process acceptance remain unproven. Draft only; no merge or release.