feat(audience): surface consent persistence failures via OnError (SDK-147)

ConsentStore.Save can fail from transient I/O (disk full, locked file,
permissions). Previously the catch handler at ImmutableAudience.cs:318
logged a warning and returned silently - studios had no programmatic
signal that their consent change wouldn't survive a restart.

Adds AudienceErrorCode.ConsentPersistFailed, distinct from
ConsentSyncFailed (backend PUT) so operators can tell the two failure
modes apart: a Save failure means local state will revert on relaunch,
a Sync failure means the backend audit trail is out of sync but local
state is fine.

In-memory behaviour is unchanged - the new level still applies to the
current session, the purge/downgrade still runs. The callback just
gives studios a hook to warn the player, log to their telemetry, or
retry the persist at a better moment.

New test pre-creates a directory at the consent file path to force
File.Move to fail, then asserts ConsentPersistFailed reaches OnError.
155 passing.

Linear: SDK-147

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/AudienceError.cs

@@ -7,7 +7,9 @@ public enum AudienceErrorCode
         FlushFailed,
         ValidationRejected,
         ConsentSyncFailed,
-        NetworkError
+        NetworkError,
+        /// <summary>Failed to persist the consent level to disk. In-memory level still applied but will revert on next launch.</summary>
+        ConsentPersistFailed
     }
 
     public class AudienceError : Exception

src/Packages/Audience/Runtime/ImmutableAudience.cs

@@ -322,6 +322,8 @@ public static void SetConsent(ConsentLevel level)
             {
                 Log.Warn($"SetConsent — failed to persist consent level: {ex.GetType().Name}: {ex.Message}. " +
                          "In-memory level is updated but will revert on next launch.");
+                NotifyErrorCallback(config.OnError, AudienceErrorCode.ConsentPersistFailed,
+                    $"Consent persist failed: {ex.Message}");
             }
 
             if (level == ConsentLevel.None)

src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs

@@ -596,6 +596,30 @@ public void ResetState_ClearsIdentityCache_AcrossInitWithDifferentPath()
             }
         }
 
+        [Test]
+        public void SetConsent_PersistFailure_SurfacesOnError()
+        {
+            // Pre-create a directory where ConsentStore.Save wants to place
+            // the consent file; File.Move then fails without disturbing
+            // Init's DiskStore or Identity paths.
+            var consentFile = AudiencePaths.ConsentFile(_testDir);
+            Directory.CreateDirectory(consentFile);
+
+            // Bag rather than single capture: ConsentPersistFailed fires
+            // synchronously on the caller thread, SyncConsentToBackend's
+            // Task.Run may also fire ConsentSyncFailed concurrently. Assert
+            // presence of the one under test rather than the last seen.
+            var errors = new System.Collections.Concurrent.ConcurrentBag<AudienceError>();
+            var config = MakeConfig(ConsentLevel.Anonymous);
+            config.OnError = err => errors.Add(err);
+
+            ImmutableAudience.Init(config);
+            ImmutableAudience.SetConsent(ConsentLevel.Full);
+
+            Assert.That(errors.Any(e => e.Code == AudienceErrorCode.ConsentPersistFailed),
+                Is.True, "OnError should receive ConsentPersistFailed for consent persist failure");
+        }
+
         [Test]
         public void SetConsent_PersistsAcrossInit()
         {