Make backup failures visible and retry transient NAS reads

[AlexanderSmyslowski]

What changed

• Mark automatic backup failures as time-sensitive without opening or activating the app.
• Embed and verify the required notification entitlement in local builds, source installs, and release packages.
• Retry destination_unreadable exactly once after 30 minutes, using the existing bounded NAS retry flow.
• Keep permanent safety failures such as permissions, invalid manifests, name collisions, unsupported tooling, and unclassified exit codes non-retryable.
• Prepare version 2.4.1 (build 25) and update release/version documentation.

Root cause

The scheduled 20:00 run failed during the fail-closed NAS codec-manifest read check. macOS accepted the resulting notification but muted its banner and sound because Do Not Disturb was active. The retry policy announced/retried only mount availability failures, even though destination_unreadable is also a read-only preflight failure that is safe to recheck later.

User impact

Future automatic failures are eligible for Time Sensitive presentation during Focus while remaining non-modal and fullscreen-safe. A transient NAS destination read failure now receives one delayed retry and an alert that states a retry is planned.

Validation

• Test-first regression coverage for retry policy, alert wording, notification interruption level, and signing entitlement.
• Full make test suite passed.
• Isolated Universal 2 app build and codesign entitlement check passed.
• Unsigned v2.4.1 package build and packaging/verify-pkg.sh --expect-unsigned passed.
• scripts/validate-release.sh v2.4.1 passed.