feat(openai)!: expose typed Responses retry observability

[danielkov]

Summary

Expose typed, sanitized Responses retry progress through loop observers and retain provider classification and retry accounting in terminal model failures. This supplies the upstream contract needed by Kit #45, #46, and #47.

Motivation

Initial retries occur inside begin_turn, before a model stream is available. Hosts need live progress during those waits and structured terminal metadata without parsing provider error strings.

Impact

Responses model-session failures now use LoopError::ProviderFailure, with an accessor for typed metadata. This is a breaking change for exhaustive LoopError matches. Existing serialized AgentEvent variants remain unchanged, but readers must understand the new retry variant before it crosses a versioned boundary.

The host still owns ACP delivery, fatal-record persistence, stable fatal correlation, and effects provenance. Downstream integration requires coordinated reader updates and separately published compatible crates.

Technical details

Bounded observations across request setup and streaming

A default-compatible ModelSession::set_retry_observer hook forwards Scheduled, Stopped, and Succeeded observations through AgentEvent::ProviderRetry. Scheduled snapshots are limited to one per 250 ms per model request, with no queue and unsuppressed terminal observations. These are not additional model results or effects records.

Sanitized classification and exact accounting

Canonical allowlists retain upstream type/code separately from local terminal and last-attempt reasons; unknown values become Unknown. No provider messages, response bodies, credentials, prompts, or endpoint URLs enter the payloads. Attempts count polled HTTP client executions, including reactive-authentication resends. Completed backoff sums only fully completed requested waits; elapsed time begins before authentication.

Explicit cancellation and deadline precedence

LoopError::Cancelled remains unchanged, with accounting available through the terminal observation. A default-compatible ModelTurn::on_cancelled hook finalizes library-owned post-event cancellation before the driver drops a turn. Cancellation and logical deadlines win ready-completion races, including buffered stream completion; arbitrary dropped futures do not promise terminal delivery.