Address review: scope the sentinel to size failures and stop the budget leaking

Three blockers, all real, all mine.

The permanent-failure gate sat OUTSIDE the size-failure branch and keyed off !subdivide, which is true for everything that is NOT a size rejection. So any ordinary failure — 401, 500, connection reset, a declined hook — on an indivisible checkpoint was reported as ErrCheckpointExceedsTargetLimit, telling the worker to stop redelivering a repo that needed one retry. Exactly backwards. The classification now lives inside the size branch, so an unrelated error cannot reach it.

A genuine 413 could never reach the sentinel either: the relaxed retry requires abortedEarly, so relaxedRetried stayed false and the gate was skipped. A first checkpoint push hard-rejected by the target stayed in the redelivery loop forever — the failure this change exists to end. Terminal now covers both verdicts the target can give: a rejection it sent, or a retry that already ran at its announced limit and still overshot.

The relaxed ceiling was written into selfImposedBudget, which spans every checkpoint and every branch, so it never came back down: later packs uploaded in full instead of aborting at the small budget the pre-flight still plans against, and branch 2+ silently lost both the retry and the classification. It is now a per-attempt value, cleared when the checkpoint advances.

Also from the review: isIndivisibleCheckpoint measured from Checkpoints[idx-1] instead of current, so on the stale-temp-ref resume path — the ENT-2054 route — it counted the gap from the chain root and answered "divisible" for a span subdivision had just proved otherwise; it now takes current and is one subtraction rather than a chain-wide map per failure. In-loop rejections feed AnnouncedTargetLimit, so a run entering batching without a one-shot attempt can still relax. A ratcheted-down budget derived from bytes actually sent is treated as a measured cutoff the retry must not jump past. Batching/RelayMode are set where the route is chosen rather than where it succeeds. The sentinel is aliased into the root package, since the internal one is unimportable by the worker that has to match on it. Result carries Plans and Measurement on the error path, and the client wrappers no longer zero it.

Tests: unrelated-error-stays-retryable (four shapes), hard-rejection-is- permanent, and relaxed-budget-does-not-leak. Each was confirmed to fail with the corresponding bug reintroduced.