fix(generate): include a dependency's retry shims in a dependent's needs

[joshua-temple]

Problem

A dependent deploy's if: gate already reads needs.<dep>-retry-N.result to judge its dependency's effective (ladder-wide) result, so a retry-rescued dependency does not skip its dependents. But the dependent's needs: list was built from GetDirectDependencies alone, which returns only the base dependency's job ID, never its retry shims.

GitHub Actions can only resolve a needs.<job> reference for a job actually listed in that job's needs:. The emitted pair silently disagreed:

• deploy-notify.needs = [setup, deploy-app]
• deploy-notify.if references needs.deploy-app-retry-1.result

actionlint rejects this at parse (property "deploy-app-retry-1" is not defined in object type ...), and had it somehow been accepted, the reference resolves to an always-empty value at runtime, so a retry-rescued dependency (base fails, a shim succeeds) would leave the dependent silently skipped instead of running.

The finalize job's needs: already listed retry shims correctly; only a dependent deploy'sneeds: was missing them.

Fix

internal/generate/generator.go:

• Added retryShimJobIDs(jobID, retries) as the single source of truth for a job's shim IDs.
• writeCallbackJob's needs: construction now appends each hard dependency's retry shims right after the dependency itself.
• retrySucceededCond (the if: gate builder) and writeFinalizeJob's job collection now both derive from the same helper, so the needs: list and the if: gate can no longer drift apart.
• A dependency with no retries is unaffected: needs: collapses to the bare dependency job ID, byte-identical to before.

Verification

• internal/generate/pass10_silent_output_test.go: added TestGM7_DependentDeploy_NeedsIncludesRetryShims (red before the fix: needs: [setup, deploy-web]; green after: needs: [setup, deploy-web, deploy-web-retry-1, deploy-web-retry-2]) and TestGM7_DependentDeploy_NoRetries_NeedsByteIdentical (proves the no-retries path is unchanged).
• internal/generate/correctness_census_map_test.go: deploys[].depends_on[] now points at TestGM7_DependentDeploy_NeedsIncludesRetryShims.
• internal/generate/actionlint_feature_matrix_test.go: added the retries_dependent_deploy case, pairing retries with depends_on so this exact combination stays under permanent actionlint guard (the pre-existing retries case never exercised a dependent deploy, which is why the matrix hadn't caught this).
• e2e/scenarios/73-deploy-retries.yaml: extended with a notify deploy that depends_on the retried web deploy. Asserts the emitted needs: line carries the base dependency plus both retry shims, and that notify correctly skips in the non-rescue path (the scenario's callback always fails, so no rescue occurs). The true rescue-runtime proof (base fails, shim succeeds, dependent runs) is documented as out of reach for this harness for the same structural reason the existing ladder proof already states (no artifact server, no cross-job state channel, identical github.job across shims); the needs:/if: agreement it depends on is instead pinned by the two unit tests above.
• docs/src/content/docs/internals/coverage-matrix.md: filled in the 73-deploy-retries scenario reference for "Callback retry wrapper", which was blank.
• go build ./... && go test ./... && go test ./... -race && golangci-lint run ./... all clean on the root module; go build ./... && go vet ./... && go test ./... -short && golangci-lint run ./... clean on the e2e module.

[github-actions]

All PR Validation checks passed.