fix(chain): retry transient coinset failures + resume pending mint (#84)

[MichaelTaylor3d]

TLDR

Fixes DIG-Network/dig_ecosystem#84 — a live user (dkackman) was blocked minting a store on mainnet because coinset.org intermittently truncates an HTTP response body under load (error decoding response body) and digstore's chain-read layer had no retry/backoff/timeout. A single hiccup aborted digstore doctor (fund scan) and digstore init (mint) — once even AFTER the mint spend was already broadcast (submitted mint …), so the flow died with the user's XCH already spent.

What changed

• Robust coinset RPC wrapper (crates/digstore-chain/src/coinset.rs): every read now goes through Coinset::call → retry_core, wrapping the underlying RPC in retry-with-exponential-backoff + full jitter + a per-attempt timeout. Classification: truncated body (is_decode), transport/connect/request/body errors, timeouts, 5xx, 429 are retryable; a definitive not-found / other 4xx is terminal (returns immediately, never a hang). Centralized so every call site benefits — covers get_coin_records_by_puzzle_hashes, _by_hint, _by_puzzle_hash, _by_parent_ids, get_coin_record_by_name, get_puzzle_and_solution, get_blockchain_state, and push_tx.
• Concurrency: reads are issued sequentially (the wallet scan loops address-by-address), so concurrency is already bounded to 1 — digstore never triggers coinset's parallel-fan-out volume failure (#62). No concurrency limiter added (would be dead code).
• Post-submit resilience: confirmation polling (ChainAnchor::confirm → coin_record) now survives a transient error via the same retry. Re-running digstore init <name> after a submitted-but-unconfirmed mint RESUMES confirmation of the existing coin (reusing the exact digstore anchor resume logic) instead of minting a second singleton — never double-spends real XCH. A confirmed/non-anchored store on disk is still a genuine name collision (exit 2).
• No endpoint change — chain reads stay on coinset.org (rpc.dig.net is not a coinset proxy, #62). push_tx retry is safe: the tx id is deterministic, so re-submitting the identical bundle is idempotent at the mempool.

Tests (TDD, all new, kept permanently)

• retry_recovers_from_transient_then_succeeds — a transient failure then success returns success, not an abort (acceptance a).
• retry_does_not_retry_terminal_error / coinset_not_found_is_terminal_single_call — a definitive not-found is NOT retried into a hang (acceptance b).
• retry_exhausts_attempts_on_persistent_transient, retry_recovers_from_per_attempt_timeout — bounded attempts + timeout-is-retried.
• coinset_retries_truncated_body_then_succeeds — end-to-end through the REAL reqwest path via a local TCP server that truncates the first body then serves valid JSON.
• confirm_survives_transient_then_confirms — post-submit confirmation survives a transient error → Confirmed (acceptance c).
• init_rerun_after_pending_mint_resumes_without_reminting — re-running init after a submitted mint resumes; coin_id unchanged proves no re-mint / double-spend (acceptance d).

Verification (this session)

• cargo test -p digstore-chain: 188 passed, 0 failed (3 ignored live).
• cargo test -p digstore-cli: 453 passed, 0 failed (2 ignored live) — full integration suite, incl. all init/doctor/anchor tests.
• cargo fmt --all clean; cargo clippy -p digstore-chain -p digstore-cli --all-targets --all-features -- -D warnings clean.
• §3.5: cargo install --path crates/digstore-cli --force --locked → digstore 0.7.1; installed-binary integration tests green.
• (Local note: cargo clippy --all-targets for the whole workspace hits a pre-existing risc0-zkvm host-linker error in digstore-prover's build script on Windows — unrelated to this change and unaffected by it; CI runs on Linux.)

SemVer

patch 0.7.0 → 0.7.1 — a backwards-compatible bug fix (fix:), no public-API or behavior change beyond added resilience.