feat: Remove permanent failure modes from FDv1 following RETRY spec

[jsonbailey]

BEGIN_COMMIT_OVERRIDE
feat: Retry indefinitely after a data source failure instead of stopping permanently in FDv1
fix: Warn and use the documented default for an invalid poll interval or initial reconnect delay
END_COMMIT_OVERRIDE

Summary

Brings the FDv1 streaming and polling data sources into conformance with the RETRY specification. No HTTP response and no transport-level failure stops a data source permanently any more.

Every failure is classified normal or unexpected. A normal failure retries on the existing curve — 1s doubling to a 30s ceiling for streaming, the poll interval for polling. An unexpected failure (401, 403, any other 4xx outside 400/408/429) moves to a longer regime starting at 5 minutes and doubling to a 1-hour ceiling, and keeps retrying there until the condition clears.

The retry state machine itself landed in #522; the delay-source plumbing landed in #521. This PR connects them to the four data sources and removes the permanent-stop paths.

Behaviour changes for release notes

1. A bad or revoked SDK key no longer fails fast. LDClient(config, start_wait=N), postfork(start_wait=N) and await client.start(start_wait=N) now block for the full start_wait and return with is_initialized() false, rather than returning at once. The SDK keeps retrying in the background.
2. DataSourceState.OFF is now reserved for explicit shutdown and unparseable configuration. HTTP errors produce INTERRUPTED.
3. A rejected SDK key now logs at error roughly hourly, indefinitely, rather than once. An SDK retrying with a rejected credential consumes resources, and the condition needs a person to fix it.
4. A server-initiated stream close now logs a warning where it previously logged nothing, and backs off rather than reconnecting immediately.
5. Failure logs now state the actual delay — Received HTTP error 401 (invalid SDK key) for stream connection - will retry in 300.0s. Previously the SDK said only "will retry", and the delay was logged separately at info by the SSE client, so it was invisible at default log levels.
6. An invalid poll_interval or initial_reconnect_delay now logs a warning and uses the documented default. poll_interval was silently clamped and initial_reconnect_delay was not checked at all.

What changed

• impl/datasource/{streaming,async_streaming,polling,async_polling}.py — the permanent-stop paths are gone. Each failure is classified, the retry state advances, status becomes INTERRUPTED, and the wait is interruptible by stop(), which matters now that a wait can be an hour long.
• config.py / async_config.py — both intervals are validated. Config previously clamped poll_interval with max(), which let NaN and inf through, because every comparison against NaN is false. A NaN interval reached Event.wait() and the delay arithmetic. The 30-second minimum still applies on top of validation.
• impl/util.py — validate_positive_finite, beside the validators Config already imports, so config and retry share it without either importing the other.
• impl/retry.py — uses the shared validator; the two configurable defaults now live in config.py next to DEFAULT_STREAM_URI.
• impl/datasource/datasource_common.py, interfaces.py, client.py / async_client.py — docstrings and status handling updated for the above.
• impl/aio/transport.py — the async transport's own retry is driven by the shared state.
• contract-tests/ — both services declare the conformance capability.

Known gaps, deliberately out of scope

• FDv2 (impl/datasourcev2/**, impl/datasystem/**) still stops permanently on an unexpected response. Tracked as SDK-2776.
• The event processor's _disabled permanent stop stays. No spec binding exists for it yet. Also SDK-2776.
• SSE action loops have no except. "A data source never stops" holds via ld_eventsource internals rather than by construction. No reachable escape path was found at the pinned version.

Testing

make test: 1681 passed. make lint: clean across 228 files.

Contract tests were run out of band against harness v2.41.0 — streaming's eight conformance subtests and polling's four all pass. Note the conformance scenarios need -enable-long-running-tests, which the Makefile does not pass, so they do not run in CI.

---

Note

Overview
Aligns FDv1 streaming and polling (sync and async) with the RETRY spec: failures no longer shut the data source down permanently.

Retry ownership moves from the SSE client into the SDK via shared RetryState (for_streaming / for_polling). Each failure is classified normal vs unexpected (HTTP via classify_http_status); backoff is applied on the polling/stream loops, logs include the actual retry delay, and stop() can interrupt waits (including long extended backoffs). Async SSE creation uses sdk_managed_retry=True so the library does not sleep on its own.

Behavioral shifts: 401/403/most other 4xx → INTERRUPTED and keep retrying (extended regime from ~5m up to 1h) instead of OFF and giving up; OFF is terminal and only for explicit shutdown (in-flight work cannot update status after OFF). Server-initiated stream closes are treated as StreamClosedError with normal backoff, not ignored. Invalid poll_interval / initial_reconnect_delay warn and fall back to DEFAULT_* in config.py; RepeatingTask caps waits with TIMEOUT_MAX.

Docs and DataSourceState semantics are updated; contract-test services advertise retry-conformance-fdv1-streaming and retry-conformance-fdv1-polling. Test coverage expands for the new retry, logging, and shutdown paths.

^{Reviewed by Cursor Bugbot for commit b2f719e. Bugbot is set up for automated code reviews on this repo. Configure here.}