fix(supervise): separate completion from failure retries

[drewstone]

Problem

Cloud directors could preserve their session and still stop after eight successful, incomplete invocations.
Continuation consumed the failure retry allowance, and no completion-driven continuation policy existed.
This follows the retained-session repair and adopts #1258's consecutive-failure reset without duplicating it.

Change

• Add repromptOnUnmet: 'until-complete' to the existing supervise contract.
  It requires a completion check and finite positive budget deadline.
• Count failed invocations, not successful continuations, against driverRetry.maxAttempts.
  Keep monotonically increasing attempt identities and the independent continuation count.
• Preserve numeric continuation caps and zero-disable behavior.
  Cancellation, explicit stop, terminal failures, unknown cost, resource limits, and deadlines remain enforced.
• Preserve the original provider failure when recording unknown cost also rejects.

No new execution loop, scheduler, provider wrapper, transport, or Lab runtime policy.
maxAttempts now means cumulative failed invocations within the driver run, with the existing default eight and minimum one.
Successful invocations reset the consecutive-failure streak, not the cumulative failure allowance.
The unpublished 0.232.0 release carries the public type change.

Verification

Failure-first checks: 13 failed and 54 passed on the unmodified prerequisite.
Full local suite: 4,068 passed and 11 existing skips before the final error-reporting refinement.
Final integrated source and public-provider suites: 323 passed across nine files.
Typecheck, lint, generated API freshness, version gate, and packed-package verification passed on the integrated candidate.
The public provider regression proves 12 distinct turns in one retained environment and session.
The interruption regression recovers the admitted continuation without a third dispatch.
Independent review found no substantive continuation findings and passed 25 additional admission-boundary probes.
The exact external-provider create regression uses enabled retries and checks one attempt, retained original cause, and unknown cost.
Accounting failure remains a terminal Runtime error; retaining a transient provider cause does not authorize another dispatch.

Local tests use deterministic providers and real authenticated coordination HTTP.
They do not establish live multi-hour fleet reliability.
#1246 remains open until the cloud continuation, interruption, child-consumption, and evidence qualification passes.

Related system issue: SYS-011 — outcome: mitigates — proof: continuation and retained-owner recovery regressions in this PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[drewstone]

Release owner: exact head 78f2fdc passed local integrated regression coverage (323 tests), typecheck, lint, generated-doc freshness, version gate and packed-package verification. Independent continuation and accounting-boundary reviews have no unresolved findings. Full local suite on the preceding candidate passed 4068 tests with 11 skips; this is not a final-head full-suite claim. All four GitHub checks now pass. GitHub review bot could not review because its quota is exhausted; separate local reviews were completed, not attributed to that bot. Using the user-authorized admin merge for the missing second-account approval. Runtime 0.232.0 publication remains owned here; issue #1246 stays open pending actual cloud acceptance.

[drewstone]

Consumer integration owner readback: Runtime 0.232.0 and its active publisher remain owned by #1260. I am preparing the separate Sandbox 0.41 compatibility patch from merged 602e4fb in /tmp/agent-runtime-sandbox041, targeting Runtime 0.232.1 and Bench 0.13.3. Scope is compatible published dependency ranges, exact SDK checks, and generated release metadata. I will not mutate the 0.232.0 tag or interfere with its publisher. App, Traces, and ADC need this supported range because ADC now contains workspace Sandbox 0.41.0. Please preserve this release version for that bounded patch.