…ker infra

The state backend was the only mutation path in rocky-core without retry /
circuit-breaker parity with the adapter layer (compare [adapter.databricks.retry]
wiring in rocky-databricks::connector). This commit closes that gap.

Changes:

* [state.retry] — new RetryConfig block on StateConfig. Shares shape with
  [adapter.databricks.retry]; same `max_retries`, `initial_backoff_ms`,
  `max_backoff_ms`, `backoff_multiplier`, `jitter`,
  `circuit_breaker_threshold`, `circuit_breaker_recovery_timeout_secs`,
  `max_retries_per_run` fields so operators reason about both with one
  mental model. Reuses the existing
  `rocky-core/src/{circuit_breaker,retry_budget}.rs` helpers already
  battle-tested by the Databricks adapter.

* [state] on_upload_failure = "skip" | "fail" — new
  `StateUploadFailureMode` policy applied after retries + circuit are
  exhausted. Default `skip` matches the de-facto behaviour of existing
  `rocky run` callers that already `warn + continue` on upload failure;
  `fail` is the opt-in strict mode for environments that treat state
  durability as a hard requirement.

* New `StateSyncError` variants — `CircuitOpen` and
  `RetryBudgetExhausted` so terminal retry outcomes surface with
  attribution instead of masquerading as transport errors.

* state.upload span — now carries a `retries` field on the terminal
  `"state upload complete"` event, plus intermediate
  `outcome = retry | circuit_open | budget_exhausted | transient_exhausted`
  events from the retry loop. Groundwork from the prior
  `outcome` -field commit is now driven by actual retry state.

* Retry loop is wrapped by the existing `with_transfer_timeout` so the
  configured `transfer_timeout_seconds` (default 300 s) remains the total
  wall-clock ceiling — retries *share* the budget rather than extend it.
  Preserves the liveness property the per-request HTTP timeout already
  gave us.

* Tiered backend recursion now calls the internal `dispatch_upload`
  instead of the public `upload_state`, so `on_upload_failure` is
  evaluated exactly once at the outermost call rather than twice per leg.

Tests:

* 9 new unit tests covering `is_transient` classification, `compute_backoff`
  math (±25 % jitter envelope), `retry_transient` success/give-up/permanent-
  error/budget-exhaustion paths.

* 2 new wiremock integration tests — `upload_state_retries_transient_then_succeeds`
  (one 500 then 200, under 3 s) and
  `upload_state_hung_endpoint_skip_mode_converts_to_ok` (hang + default
  `skip` mode returns `Ok` within budget).

* `upload_state_times_out_on_hung_endpoint_fail_mode` — renamed
  original test now explicit about `on_upload_failure = Fail`; still
  asserts the 2 s transfer budget.

* `compute_backoff` and `is_transient` are intentionally duplicated from
  rocky-databricks / rocky-snowflake. A follow-up PR should hoist all
  three copies into a shared `rocky-core` helper; scoped out here to
  keep the surface narrow.