fix(runtime): add bounded retry to managed node version probe

[piorpua]

Summary

Fixes a false "AionUi installation incomplete / reinstall / check antivirus" alert triggered by a single transient external-process failure during managed Node validation. In the reported incident, npm --version exited with code 7 once; the bundled runtime was actually healthy and activated ~38.8s later, so the alert was misleading and the reinstall/antivirus guidance was useless to the user.

Root cause: command_version ran the managed Node --version probe once with no retry, so a transient exit was latched into a permanent bundled_resource_invalid failure event that AionUi surfaced to the user and reported to Sentry.

Fix: Bounded retry on the --version probe, scoped entirely to AionCore. On retry success, install_and_validate_with_reporter returns Ok and never broadcasts phase=Failed, so the UI never shows the alert and never reports. classify_error and AionUi are intentionally untouched — this is Option 1 from the approved fix spec.

Changes

• crates/aionui-runtime/src/node_runtime/mod.rs: split command_version into a thin wrapper plus probe_command_version_with_retry (generic, closure-injected, unit-testable, no process spawn) and command_version_once (the original body, verbatim). The public signature of command_version is unchanged, so all node/npm/npx call sites are untouched. New private constants VERSION_PROBE_ATTEMPTS = 3 and VERSION_PROBE_BACKOFFS = [250, 500, 1000]ms (~1.75s worst case), independent of the existing copy-activation retry budget. Adds 4 inline unit tests that inject a closure and never exercise command_version_once.
• crates/aionui-runtime/src/node_runtime/managed/tests.rs: adds two #[cfg(unix)] tests that spawn real shell-script stand-ins for node/npm/npx (npm exits 7 for the first N invocations, then prints a version) and drive the real call chain command_version -> validate_runtime -> validate_managed_runtime -> bundled activation path. One covers a transient failure inside the retry budget (expects success, zero Failed phases reported); the other covers a persistent failure beyond the budget (expects bundled_resource_invalid still reported). Test-only, no product code changes.

Scope boundaries (intentional)

• classify_error (managed.rs) and all AionUi files are deliberately unchanged. Persistent failures (probe failing for the full ~1.75s budget) still classify as bundled_resource_invalid and still alert/report, to avoid under-reporting real failures.
• Retry semantics: every failed attempt (including the last) sleeps its backoff, matching activate_copy_with_retry; a persistent failure spends the full ~1.75s before the verdict. Only transient error classes (process fails to start, non-zero exit, non-semver output) reach the retry loop — "node major too low" is decided in validate_runtime, outside the probe, and is never retried.
• Logging: one warn only when a retry will follow (fields label/attempt/max_attempts/error); the budget-exhausted final failure is left to the existing caller warn in managed.rs to avoid duplicate logging; no info on retry-success; no sensitive payloads.
• Known residual (accepted, documented in the fix spec): the false alert is not fully eliminated — 3 consecutive probe failures within ~1.75s plus no node ready within AionUi's 15s reconcile window will still alert/report. Further reduction is out of scope for this fix.

Related repositories

• AionUi: no changes required for this fix. The existing reconciler, alert allowlist, and RuntimeFailureKind type are intentionally untouched.
• aionrs: not involved.

Test plan

• cargo test -p aionui-runtime version_probe — 4 new closure-injected unit tests pass (RED before implementation, GREEN after).
• cargo test -p aionui-runtime — full crate regression, 94 passed / 0 failed, including unchanged classification tests (classify_error_still_detects_bundled_invalid_by_message, classify_error_detects_bundled_node_runtime_missing, bundled_runtime_missing_reports_bundled_resource_missing).
• cargo fmt --all -- --check — clean.
• cargo clippy -p aionui-runtime -- -D warnings — clean.
• just push — full pre-push gate (migration check, lint, format, workspace test suite: 8119 tests run, 8119 passed) — clean.
• The two new #[cfg(unix)] subprocess-driven tests (added in the second commit) are not yet covered by a logged CI run against this exact HEAD in the fix archive; they ran as part of the just push workspace suite above but are worth a second look in CI given they are Unix-only and won't run on Windows, where the original incident occurred. The retry logic itself is platform-independent and is covered on every platform by the version_probe_* unit tests.
• End-to-end confirmation that the user-facing alert and the Sentry runtime-installation-integrity-failure report no longer fire on a transient-but-recoverable probe failure in a real/packaged environment is out of automated scope for this fix and has not been executed.