fix(agent): retry initial Maple response stream failures

[AnthonyRonning]

Summary

• extend Maple's existing transient retry budget through the first parsed provider stream item
• transparently replay the same serialized request through a fresh transport attempt when the stream fails before any output escapes
• stop retry eligibility after any successful item, including text, usage, or a completed tool request, and keep cancellation non-retryable
• retain the provider-local bridge only until Goose has equivalent global handling

Safety boundary

This deliberately does not replay an inference after partial output or a completed tool request, where replay could duplicate visible content, usage, or side effects. In Agent Mode, empty streams ending in [DONE] continue through Goose's existing bounded empty-turn recovery.

The change is confined to Maple's provider; it does not modify the OpenSecret backend or SDK. The temporary provider-local handling links to the upstream work in:

• Automatically retry failed API requests aaif-goose/goose#10887
• Mid-stream transient provider errors halt the agent instead of retrying aaif-goose/goose#10897

Addresses #731.

Validation

• provider tests: 27 passed
• Rust library tests: 284 passed, 2 ignored
• cargo clippy -- -D warnings
• Rust formatting and git diff --check
• frontend lint and production build
• managed OpenSecret, billing, Continuum, and Tinfoil SDK health smoke
• exact managed-workspace desktop bundle startup smoke
• three independent implementation, integration, and test reviews with no actionable findings

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	4b09d79
Status:	✅  Deploy successful!
Preview URL:	https://3ec4297e.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-731-retry-maple.maple-ca8.pages.dev

View logs