feat: Remove permanent failure modes from FDv1 following RETRY spec

[jsonbailey]

BEGIN_COMMIT_OVERRIDE
feat: Retry indefinitely after a data source failure instead of stopping permanently
fix: Warn and use the documented default for an invalid poll interval or initial reconnect delay
END_COMMIT_OVERRIDE

Summary

Brings the FDv1 streaming and polling data sources into conformance with the RETRY specification. No HTTP response and no transport-level failure stops a data source permanently any more.

Every failure is classified normal or unexpected. A normal failure retries on the existing curve — 1s doubling to a 30s ceiling for streaming, the poll interval for polling. An unexpected failure (401, 403, any other 4xx outside 400/408/429) moves to a longer regime starting at 5 minutes and doubling to a 1-hour ceiling, and keeps retrying there until the condition clears.

The retry state machine itself landed in #522; the delay-source plumbing landed in #521. This PR connects them to the four data sources and removes the permanent-stop paths.

Behaviour changes for release notes

1. A bad or revoked SDK key no longer fails fast. LDClient(config, start_wait=N), postfork(start_wait=N) and await client.start(start_wait=N) now block for the full start_wait and return with is_initialized() false, rather than returning at once. The SDK keeps retrying in the background.
2. DataSourceState.OFF is now reserved for explicit shutdown and unparseable configuration. HTTP errors produce INTERRUPTED.
3. A rejected SDK key now logs at error roughly hourly, indefinitely, rather than once. An SDK retrying with a rejected credential consumes resources, and the condition needs a person to fix it.
4. A server-initiated stream close now logs a warning where it previously logged nothing, and backs off rather than reconnecting immediately.
5. Failure logs now state the actual delay — Received HTTP error 401 (invalid SDK key) for stream connection - will retry in 300.0s. Previously the SDK said only "will retry", and the delay was logged separately at info by the SSE client, so it was invisible at default log levels.
6. An invalid poll_interval or initial_reconnect_delay now logs a warning and uses the documented default. poll_interval was silently clamped and initial_reconnect_delay was not checked at all.

What changed

• impl/datasource/{streaming,async_streaming,polling,async_polling}.py — the permanent-stop paths are gone. Each failure is classified, the retry state advances, status becomes INTERRUPTED, and the wait is interruptible by stop(), which matters now that a wait can be an hour long.
• config.py / async_config.py — both intervals are validated. Config previously clamped poll_interval with max(), which let NaN and inf through, because every comparison against NaN is false. A NaN interval reached Event.wait() and the delay arithmetic. The 30-second minimum still applies on top of validation.
• impl/util.py — validate_positive_finite, beside the validators Config already imports, so config and retry share it without either importing the other.
• impl/retry.py — uses the shared validator; the two configurable defaults now live in config.py next to DEFAULT_STREAM_URI.
• impl/datasource/datasource_common.py, interfaces.py, client.py / async_client.py — docstrings and status handling updated for the above.
• impl/aio/transport.py — the async transport's own retry is driven by the shared state.
• contract-tests/ — both services declare the conformance capability.

Known gaps, deliberately out of scope

• FDv2 (impl/datasourcev2/**, impl/datasystem/**) still stops permanently on an unexpected response. Tracked as SDK-2776.
• The event processor's _disabled permanent stop stays. No spec binding exists for it yet. Also SDK-2776.
• SSE action loops have no except. "A data source never stops" holds via ld_eventsource internals rather than by construction. No reachable escape path was found at the pinned version.

Testing

make test: 1681 passed. make lint: clean across 228 files.

Contract tests were run out of band against harness v2.41.0 — streaming's eight conformance subtests and polling's four all pass. Note the conformance scenarios need -enable-long-running-tests, which the Makefile does not pass, so they do not run in CI.

---

Note

Overview
Aligns FDv1 streaming and polling (sync and async) with the RETRY spec: data source failures no longer shut down permanently. Failures are classified as normal vs unexpected (e.g. most 4xx including invalid SDK keys), drive shared RetryState backoff, report INTERRUPTED, and keep retrying—including multi-minute/hour waits that stop() can interrupt.

Retry ownership moves to the SDK: SSE clients are created with sdk_managed_retry so reconnect delays come from for_streaming / for_polling, not the eventsource library. Server-initiated stream closes are treated as StreamClosedError with normal backoff (not ignored tight reconnect loops).

User-visible behavior shifts: bad SDK keys no longer fail fast during start_wait—the client returns uninitialized but keeps retrying in the background. DataSourceState.OFF is reserved for explicit shutdown (not HTTP errors). Logs now include the actual retry delay; invalid poll_interval / initial_reconnect_delay warn and fall back to shared defaults in config.py.

Contract test services advertise retry-conformance-fdv1-* capabilities; docs and tests are updated across processors, transport, and e2e cases.

^{Reviewed by Cursor Bugbot for commit 30bb8ec. Bugbot is set up for automated code reviews on this repo. Configure here.}