fix(storage): retry transient lbug WAL→checkpoint race in bulkLoad

[theagenticguy]

Summary

Root-causes and fixes the macOS Verify Global Install "flake" — codehub analyze intermittently exited non-zero on loaded CI runners (the failing leg varied run-to-run; never failed on an idle box) while the graph itself built fine (the query smoke right after always passed).

Why it was undiagnosable

The analyze smoke ran codehub analyze "$FIXTURE" >/dev/null 2>&1 — so the actual error that set exit 1 never reached the CI log. That's the entire reason it read as a flake instead of a bug. Reproduced locally under contention (1/10 concurrent analyze runs failed) and captured the swallowed error:

IO exception: Error renaming file <db>.lbug.wal to <db>.lbug.wal.checkpoint.
ErrorMessage: No such file or directory

This is the native lbug binding's auto-checkpoint racing under CPU/IO pressure — the WAL→checkpoint rename fails even though the data is already durably in the WAL (a reopen recovers it). Single-process, isolated .codehub/ dir; it's timing, not cross-process contention. Unretried, it bubbles to the CLI's top-level parseAsync().catch() and fails analyze with exit 1.

Fix (two parts)

1. Retry the transient error (packages/storage/src/graphdb-adapter.ts)
GraphDbStore.bulkLoad now wraps the load in retryTransientCheckpoint — up to 3 attempts, 25/50ms backoff, gated on isTransientCheckpointError. replace-mode bulkLoad is idempotent (truncate-then-insert fully replaces), so retry is safe. The matcher keys on the stable token trio (renaming + .wal + checkpoint), not the OS-specific errno suffix. Every non-transient error rethrows immediately — no broadening of swallowed failures.

2. Make the smoke diagnosable (scripts/verify-global-install.sh)
The analyze smoke now captures combined output to a temp log and prints the tail (with rc) on failure, so a future non-zero exit shows the real cause instead of being silently swallowed. This is the durable fix — the flake was invisible only because the harness hid it.

Verification

• Reproduced the race (1/10 concurrent runs) pre-fix; 48/48 concurrent runs clean post-fix.
• storage 159/159 — 11 new tests: matcher pos/neg (real lbug string, errno variants, unrelated IO, generic checkpoint, constraint error, null/undefined) + retry policy (recover-after-N, first-try success, exhaustion-rethrow, non-transient-immediate-rethrow). Retry path proven directly via injected fn, not by provoking a native race.
• ingestion 602/602; cli 256/256; typecheck + biome clean; bash syntax OK.

Test plan

• transient error recovered within maxAttempts
• non-transient error rethrows without retry
• exhaustion rethrows after N attempts
• smoke prints analyze tail on failure