feat: pipeline backfill child workflow + never-fail error model

[tonyxiao]

Summary

Implements the pipeline backfill child workflow plan — restructures the pipeline workflow so it never fails, with backfill extracted into a child workflow that can fail independently.

Phase 1: Activity never throws for classified errors

• pipelineSync always returns { errors, state, eof } instead of throwing ApplicationFailure.retryable
• Eliminates the workflow-death path where 10 retries exhaust and the workflow dies

Phase 2: Per-stream error isolation

• Errored streams get status 'errored' in source state and are skipped on subsequent chunks
• Other streams continue to completion; eof fires when all streams are complete or errored

Phase 3: pipelineBackfillWorkflow child workflow

• Loops pipelineSync, accumulates errors across chunks, evaluates at eof
• Throws ApplicationFailure.nonRetryable if permanent errors exist, otherwise returns SourceState

Phase 4: pipelineWorkflow spawns children

• Uses startChild + Promise.race against runInterrupted() for clean cancellation
• backfillLoop runs concurrently with liveLoop in Promise.all
• Initial backfill and periodic reconcile both use the same child workflow

Phase 5: Reclassify system_error

• Network errors (ECONNRESET, ETIMEDOUT, etc.) and Stripe 5xx → transient_error
• Everything else stays system_error, now classified as permanent

Phase 6: TraceErrorException

• collectMessages throws TraceErrorException preserving failure_type instead of plain Error

Phase 7: Recovery signals

• credentials_updated, config_updated, deployment_updated signals trigger error recovery

Test plan

• All 20 service workflow tests pass (2 pre-existing skips)
• All 100 source-stripe tests pass
• All 46 protocol tests pass
• New test: "continues past returned transient errors without entering error state"
• Build passes (pnpm build)
• Lint passes (pnpm lint)
• Format passes (pnpm format)

Plan doc: docs/plans/2026-04-14-backfill-child-workflow.md