fix(cli): retry sync during supervisor reconnect

[drew]

Summary

Keep a file sync retry alive through a brief sandbox-not-ready response after a gateway pod roll interrupts its SSH stream. The Kubernetes HA diagnostic showed a download that retried a broken stream, then failed while the supervisor was reconnecting.

Related Issue

Part of the #3583 stability campaign. This is a localized bug exposed by the expanded HA E2E run.

Changes

• Allow bounded sync retries for sandbox-not-ready only after a retryable transport failure.
• Increase the bounded attempt count to cover supervisor reconnect during a gateway roll.
• Add retry classification and observed-sequence unit tests.
• Document the HA sync behavior in the architecture and sandbox user guide.

Testing

• Focused CLI retry filter tests: 4 passed.
• Observed transport/readiness retry sequence test: passed.
• mise run pre-commit.
• mise run ci.
• Expanded GitHub Actions diagnostic on this PR's stack tip.

Checklist

• Conventional Commit with DCO sign-off.
• Stacked with gh stack.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3602.docs.buildwithfern.com/openshell

[drew]

Closing to narrow the automated flake investigation to the four selected fixes (#3583/#3588, #3598, #3604, #3608). The findings remain available here for later follow-up.