fix(upgrade): honor one scheduled convergence retry

[fuller-stack-dev]

Summary

• allow upgrade health acceptance to wait for exactly one supervisor-scheduled
  gateway retry after a nonzero backoff
• require an observed restart count and valid, non-stale nextRetryAt
• remain fail-closed for missing, malformed, stale, or changed-count retry state
• add a lifecycle integration fixture for transient convergence

The supervisor remains the sole owner of scheduling and starting the retry.
OCM only observes the published retry state and continues polling health.

Behavior

On canonical base d1c36adda05c1129af9788be35528bc1240d95da,
upgrade_waits_for_one_supervisor_convergence_retry failed because OCM rolled
back immediately on the first failed backoff:

outcome=rolled-back
service restart did not recover: fixture target failed

With this change, the same fixture waits for the published attempt, observes
the gateway become healthy, and keeps the target runtime. A changed restart
count is terminal, so a second failed attempt still rolls back.

Validation

• transient integration fixture: 1/1 passed
• scheduled-retry decision controls: 2/2 passed
• upgrade unit module: 12/12 passed
• persistent-unready rollback guard: 1/1 passed
• complete upgrade_command_tests: 45/45 passed
• cargo fmt --all -- --check
• git diff --check
• source-blind behavior validation: clauses 1-6 passed; untouched-surface
  clause remained black-box-unprovable and was confirmed by source-aware scope
• autoreview: clean, no accepted/actionable findings

Coordination

PR #60 also changes src/cli/upgrade.rs and
tests/upgrade_command_tests.rs, but this PR intentionally contains no
snapshot, restore, OpenClaw convergence-exit, global retry-policy, or
runtime build-local changes.

If #60 lands first, rebase this branch onto the resulting main and rerun the
upgrade proofs. If this PR lands first, #60 should preserve the one-retry gate
when rebasing its upgrade-health helper.