repair: per-row embed-failure exit code + ftsIndexConsistent swallows 'database is locked'

[edheltzel]

Source: PR #62 review should-fixes (deferred from the merge).

Two related robustness gaps in recall repair:

1. The PR's own documented policy is exit 0 "unless another requested repair failed" — but per-row embed failures with the service UP still exit 0 even at 100% failure rate. The implementation misses the policy's own clause.
2. ftsIndexConsistent swallows database is locked as "consistent" — a normal condition given Recall's concurrent writers — masking a real check failure as a pass.

Fix sketch: count per-row embed failures into the exit-code decision; treat locked-DB during the FTS check as "unknown/retry", never "consistent".