fix: handle 'marked for deletion' as not-found, retry in list test

Secrets deleted without force_delete enter a recovery window where
get() returns InvalidRequestException("marked for deletion") instead
of ResourceNotFoundException. Treat both as not-found.

ListSecrets is eventually consistent — newly created secrets may not
appear immediately. Add a brief retry loop in the list test.

Author: ceejbot

crates/zerolease-store-aws-sm/src/store.rs

@@ -205,9 +205,14 @@ impl AwsSecretsManagerStore {
         serde_json::from_str(s).map_err(|e| Error::Storage(format!("payload deserialization failed: {e}")))
     }
 
-    /// Check if an AWS SDK error message indicates a not-found condition.
+    /// Check if an AWS SDK error indicates the secret doesn't exist.
+    ///
+    /// Matches both `ResourceNotFoundException` (never existed) and
+    /// `InvalidRequestException` with "marked for deletion" (deleted
+    /// without force, still in recovery window).
     fn is_not_found(err_debug: &str) -> bool {
         err_debug.contains("ResourceNotFoundException")
+            || err_debug.contains("marked for deletion")
     }
 
     /// Strip our prefix from an SM secret name to recover the zerolease name.
@@ -703,10 +708,21 @@ mod tests {
             .await
             .expect("put should create second secret for list test");
 
-        let list = store.list().await.expect("list should return stored secrets");
+        // ListSecrets is eventually consistent — retry briefly if
+        // not all secrets are visible yet.
+        let mut list = Vec::new();
+        for attempt in 0..5 {
+            list = store.list().await.expect("list should return stored secrets");
+            if list.len() >= 2 {
+                break;
+            }
+            if attempt < 4 {
+                tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+            }
+        }
         assert!(
             list.len() >= 2,
-            "expected at least 2 secrets in list, got {}",
+            "expected at least 2 secrets in list after retries, got {}",
             list.len()
         );