#18308 Back off guest prompt sync on refusals instead of polling every 8 s

cmux-prompt-sync re-fetches https://reflection.cmux.internal/name every 30 s after a success, but on any failure it backed off 1, 2, 4, 8 s and then retried every 8 s forever. A guest whose credential is refused therefore polled ~3.75x as often as a healthy one; that is most of the current 401 flood on /api/vm/reflection/name (~23 req/s), whose server-side cause is fixed in https://github.com/manaflow-ai/cmux/pull/18307.

retry_delay keeps the fast first retries (the platform edge starts injecting the credential ~20-30 s after boot), then caps a transport, server or payload failure at the 30 s success cadence and a 4xx refusal at 5 minutes. No failure polls faster than a success.

This file is baked into the devbox snapshot, so it reaches new machines with the next bake only; running machines keep the 8 s loop (no rebake here). The resource reporter (guestResourceReporter.ts) already sleeps 30 s regardless of outcome.

Red/green on cmux-lawrence-2: bun test tests/vm-guest-prompt.test.ts, new test fails at 3ccd25d (retry_delay missing), passes at head. One OSC 7 test in that file and three agent-config tests in vm-devbox-image.test.ts fail identically on main on that host. Typecheck and eslint pass.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Fixes guest prompt sync so refused or failing guests stop polling the reflection endpoint every 8 s forever. Failures now keep fast first retries (the edge starts injecting the credential ~20–30 s after boot), then settle at the 30 s success cadence for transport/server failures and 5 minutes for 4xx refusals. No failure polls faster than a success, which removes most of the current 401 flood on the reflection endpoint.

• Adds a retry_delay helper that doubles the delay up to per-error caps, and a test covering refusal and transport failure sequences.
• The script only reaches new machines with the next devbox snapshot; running machines keep the old 8 s loop until then.

---

[!NOTE]
Low Risk
Guest-side polling timing only; reduces load on the reflection endpoint without changing success paths or published prompt identity.

Overview
Guest devbox cmux-prompt-sync no longer retries failed reflection name fetches every 8s indefinitely. It now uses a shared retry_delay policy: quick exponential retries at boot, then 30s caps for transport/server/payload errors (matching the success poll interval) and 5 minutes for 4xx credential refusals, so unhealthy guests poll less aggressively than healthy ones.

A regression test in vm-guest-prompt.test.ts asserts the refused vs transport backoff sequences.

^{Reviewed by Cursor Bugbot for commit 353a2098311ac4abc69a26be1b793ec33e4d6140. Bugbot is set up for automated code reviews on this repo. Configure here.}