feat: retry failed hosted embeddings without rebuilding

[salmonumbrella]

Operators can retry failed hosted embedding work after fixing an encoder or resource problem, without rebuilding the generation. pg embeddings retry-failed queues one capped batch for an explicitly selected active or desired generation. Existing workers process it with a fresh retry budget and lease fence; completed vectors and search activation stay in place.

The command uses the restricted PostgreSQL target and reports aggregate counts. It skips stale sources for normal reconciliation and does not call the encoder or open a local SQLite archive. Reprovisioning the current desired instance with the owner role adds the failure index on existing schemas (use the active instance if there is no desired generation); older status, worker and search paths continue to work before that upgrade. A manually altered failure index is rejected and requires owner repair; reprovisioning does not replace it.

This is the first recovery and operations slice of #1352 item 6. Raw-job recovery, retention, garbage collection, quotas and disaster rebuilds remain separate work. It depends on #1736 and #1730; while those are open, this PR against main includes their changes too. Review d9acd068 for this feature's diff.

[roborev-ci]

roborev: Combined Review (d9acd06)

Verdict: Changes require fixes for 3 findings.

High

• internal/postgres/hosted_embeddings_schema.go:187-193: The hosted embedding runtime role has broad DML access to lifecycle fields in hosted_embedding_state, allowing compromised workers to activate incomplete or attacker-written generations without Activate's checks. Remove broad state-table DML grants; restrict lifecycle fields to the owner and expose only validated cursor updates through a procedure or narrow column privileges, with database-enforced transition checks.

  Reported by: codex (security)

Medium

• internal/postgres/search_content.go:120: Hosted substring and regex content searches use a filter that assumes plain parent_session_id relationships, so raw child sessions are omitted when IncludeChildren is enabled. Pass the hosted session dialect into both content-search filter paths so raw-link relationships are used, and add hosted raw parent/child substring and regex coverage.

  Reported by: codex

• internal/config/hosted_embeddings.go:71-76: Hosted embedding profile validation accepts non-loopback HTTP endpoints, sending transcript content and bearer credentials without encryption. Require HTTPS except for loopback HTTP, reject URL userinfo, and require explicit opt-in for non-loopback plaintext endpoints.

  Reported by: codex (security)

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 1h15m53s