#3399 [comp] Production Deploy

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Automatically retries failed penetration-test runs, dedupes duplicate webhook‑triggered retries at the provider, and collapses each lineage into a single, stable run in the UI. Cleans up failure messages and keeps status/progress consistent to hide transient failures.

• New Features

  • Auto‑retry failed scans up to 2 times; dedupe concurrent retries with a deterministic Idempotency‑Key; never retry cancelled runs and block the whole lineage.
  • Collapse each scan lineage to its root id; APIs/UI show one run while provider calls follow the active attempt.
  • Mask a fresh, non‑final failed attempt as in‑progress for 10 minutes only when retry‑eligible (under the cap and has stored scan params); reveal failed otherwise or once lineage is exhausted/grace elapses.
  • Replace raw provider errors with clear, white‑labeled messages; humanize real runtime caps and fall back to a generic message for malformed or absurd caps.
  • Align progress status with report status so both surfaces are consistent.
  • Preserve an explicit empty checks list on retry; small UI tweak: remove the “Common causes” list and show the refined failure message.
  • Billing: use a unique reservation id for retries so webhook redelivery re‑debits correctly; rely on provider idempotency to dedupe scans.

• Migration

  • Add columns: attempt_number, root_run_id, retry_of_provider_run_id, retry_triggered_at, retry_blocked_at, scan_params; add index on root_run_id.
  • Backfill root_run_id for existing runs; no manual steps required.