Recover filesystem watcher overflows and hosted-review lookup failures

## Problem

Two background recovery paths can leave Orca noisy or stale:

1. On macOS, `@parcel/watcher` can report that FSEvents dropped events and a full rescan is required. Orca currently forwards this recoverable condition as a terminal watcher error, causing the desktop filesystem watcher to unsubscribe and silently stop delivering later external file changes.
2. Hosted-review lookup probes GitHub repository candidates in upstream-then-origin order. A stale, deleted, private, or otherwise unavailable upstream candidate can abort lookup before a valid origin is probed. Visible-card polling and renderer HMR repeatedly throw the resulting `repo_unavailable` failure through Electron IPC.

Other forge providers can similarly collapse transient CLI or HTTP failures into a definitive “no review” result, causing cached review state to disappear temporarily.

## Acceptance criteria

- The known macOS dropped-FSEvents condition produces a conservative full refresh without destroying a healthy subscription.
- Later file events continue after overflow on desktop, runtime, and relay watcher paths.
- Genuine watcher errors replace or terminate the untrusted subscription through bounded recovery rather than remaining silently live.
- A stale or inaccessible upstream GitHub candidate does not prevent probing a valid origin candidate.
- If all repository candidates fail, callers receive a safe typed upstream failure rather than a false “no review” result.
- Desktop IPC and paired-runtime RPC use the same provider-generic result contract.
- GitHub, GitLab, Bitbucket, Gitea, and Azure DevOps distinguish genuine review misses from transient operational failures.
- The renderer preserves the last cached review on transient failure and retries later.
- Diagnostics are structured, contain only safe opaque context, survive HMR for deduplication, and reset after recovery or an error-signature change.
- Older compatible runtimes returning `HostedReviewInfo | null` continue to work.
- Focused regression coverage exercises candidate fallback, provider failure modes, watcher continuity/replacement, transport contracts, cache preservation, and diagnostic deduplication.