Make explicit sync a strict durability boundary

[chrismccord]

Summary

• make :sync, {:sync, metadata}, and sync: true fatal when the backend returns its final write error
• preserve bounded backend retries before the strict failure and keep automatic/periodic transient failures best effort
• return a structured {:sync_failed, reason} fatal-exit reason and skip termination-time persistence
• add coverage for calls, casts, infos, continues, metadata sync, sync options, CAS conflicts, restart state, handle_sync/3, background catch-up, and bounded S3 retries
• document the durability and caller-timeout contract

Context

PR #15 identified that an explicit sync could return its normal reply after persistence failed, leaving the caller unable to distinguish durable state from an in-memory-only mutation. This implements the strict retry-then-fail contract discussed there on top of current main and supersedes that intentionally-red PR.

Built-in writes already receive max_retries: 5; the storage adapters classify and retry transient failures. DurableServer does not add a second retry loop, avoiding multiplied retries and unsafe handling of ambiguous writes.

Validation

• mix format --check-formatted
• mix test — 394 tests, 0 failures (35 excluded integration/stress tests)

Supersedes #15.