fix: retry transient proxy restoration

[kev1n77]

Summary

• retry the idempotent proxy restore transaction once after a transient failure
• retain the watchdog handle until disarm succeeds, so Drop can still retry safely
• attach stage context to restore failures and preserve both errors when the retry also fails
• split macOS explicit-restore and owner-disconnect integration scenarios into independent tests

Motivation

PR #100 exposed one transient macOS helper failure (EINVAL) in the owner disconnect restoration path, followed by a clean rerun. Review found that the session removed its watchdog handle before disarm completed, preventing a meaningful retry after any I/O error.

Verification

• cargo fmt --all -- --check
• cargo test -p codeischeap-proxy-recovery --all-targets
• cargo clippy -p codeischeap-proxy-recovery --all-targets -- -D warnings
• python -m unittest discover -s scripts/tests -v (32 passed, 1 skipped because Windows symlink creation is unavailable)
• git diff --check

Full local workspace Rust verification is deferred to CI because this Windows environment lacks Perl required by the vendored OpenSSL build. The affected crate and its complete target set pass locally.