Distinguish retryable thread-store errors from unknown write outcomes (#54664)

## What changed

Add `ThreadStoreError::Retryable` for transient failures known to be safe to retry and `ThreadStoreError::OutcomeUnknown` for writes that may already have committed. Recovery remains the operation owner's responsibility; neither category automatically triggers retries.

Preserve existing app-server error mappings and fatal session startup behavior, and report the new categories in shutdown diagnostics without exposing raw error payloads.

## Testing

Add coverage for conservative SQLx error classification, mutation error mappings, session initialization categories, and shutdown diagnostics that omit raw error payloads.

GitOrigin-RevId: 259a9bfaa6ff3cbfa2ee61a01a1f1e744c90f118

codex-rs/thread-store/src/error_tests.rs

@@ -0,0 +1,23 @@
+//! Verifies conservative classification at the shared storage error boundary.
+
+use super::ThreadStoreError;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn unclassified_sqlx_failures_remain_internal() {
+    for error in [
+        sqlx::Error::PoolTimedOut,
+        sqlx::Error::Io(std::io::Error::new(
+            std::io::ErrorKind::ConnectionReset,
+            "connection lost after write",
+        )),
+        sqlx::Error::Protocol("retryable conflict; outcome unknown".to_owned()),
+    ] {
+        let expected = format!("failed to access thread history: {error}");
+        let error = ThreadStoreError::from(error);
+        let ThreadStoreError::Internal { message } = error else {
+            panic!("unclassified SQLx failure must remain internal: {error:?}");
+        };
+        assert_eq!(message, expected);
+    }
+}