Add durable backoff for failed cron fires

[time-attack]

Summary

• address section 2 of When a model provider fails: no retry on the pi harness, no cron backoff, no failover on transient errors, and /healthz stays green #602 only
• add durable exponential backoff from 5 seconds to a 5 minute cap for thrown cron-fire failures in interval and pg-boss modes
• preserve scheduled slots, fire keys, and idempotency keys across retries
• use persistent CAS fencing and recoverable transitions across crashes, edits, duplicate failures, and newer busy holds

Credit to @ianTPE for reporting and reviewing the cron retry failure.

Scope

This does not change provider error classification, model failover, health checks, or broader cron outcome semantics.

Verification

• 224 affected tests passed against real PostgreSQL with 0 failures and 0 skips
• root and contract typechecks passed
• ESLint, oxlint, formatting, and diff checks passed
• both independent reviews approved the final commit

QA

Deterministic interval and pg-boss QA used real PostgreSQL and injected thrown and busy outcomes. Real Slack end-to-end QA was not run.