…e upstream (#3017)

ADR-0097 made every declarative-connector materialization failure fatal at
boot — right for configuration faults, wrong for operational ones: a
provider: 'mcp' instance must contact its MCP server (tools/list) to
materialize, so a transient network blip aborted the whole app boot.

- spec: ConnectorUpstreamUnavailableError (code CONNECTOR_UPSTREAM_UNAVAILABLE,
  structural guard isConnectorUpstreamUnavailable) lets a provider factory mark
  a failure as 'upstream temporarily unreachable — degrade and retry' instead
  of fatal. New integration/connector-provider-errors.ts; api-surface +3.
- service-automation: the reconcile degrades such instances in BOTH modes.
  With no live connector under the name it registers an action-less husk —
  state: 'degraded' + degradedReason on the GET /connectors descriptor,
  status: 'error' on the def — so the instance stays visible instead of
  silently missing; connector_action dispatch fails with the reason and a
  'retries automatically' pointer. On a changed-config re-materialization the
  old connector keeps serving. Degraded instances retry on an exponential
  backoff (5s doubling to 5min, reset by config edits) and on every
  metadata:reloaded reconcile; recovery swaps the husk atomically. Reconcile
  runs (boot / reload / retry timer) are serialized; destroy() cancels the
  retry loop.
- connector-mcp: connect / tools/list failures are classified unavailable;
  transport-shape validation stays a plain (fatal) throw.

Configuration faults (unknown provider, invalid providerConfig, unresolvable
credentialRef, name conflicts) keep the ADR-0097 fail-loud contract, verified
by the existing tests. ADR-0097 gains an 'Upstream availability' section; the
deferred live-mcp showcase demo and the openapi remote-URL classification are
recorded as scope boundaries.

Tests: 10 new reconcile cases (degrade visibility, pointed dispatch error,
fake-timer recovery, exponential backoff, reload retry, removal while
degraded, changed-config keeps old serving, revert cancels retry, shutdown
cancels retry, plain-throw still fatal); 3 new mcp-provider classification
cases; 3 new spec error-contract cases.

Refs #3017 (mechanism; showcase demo deferred — see ADR scope boundaries)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pbmw3pMqNJfPbkvwh9Fkjs

#3049's squash (4f8c2d1) is content-identical to this branch's base commit,
so this merge only rebases the PR surface — the three-dot diff vs main now
shows the #3055 gate alone.

# Conflicts:
#	docs/adr/0097-declarative-connector-instances.md
#	packages/connectors/connector-mcp/src/mcp-provider.test.ts
#	packages/connectors/connector-mcp/src/mcp-provider.ts