fix(server): harden shell catch-up replay against silent event drops

[QuinRiva]

Summary

• retry shell event projection lookups during afterSequence catch-up, then propagate failures loudly so the client self-heal path can recover instead of persisting past dropped events
• cap catch-up replay at 500 events and fall back to a full snapshot for larger gaps or client-ahead sequences, without changing the wire contract
• subscribe the cold shell leg with expected-failure retry and move live-leg mapping onto the consuming stream so buffered failures surface as OrchestrationGetSnapshotError
• include the signed design note in plans/2026-07-19-shell-catchup-silent-drop.md

Upstream sync note

This intentionally diverges from upstream pingdotgg#2968: Loom keeps the existing shell wire contract and hardens replay/self-heal semantics locally, so future upstream syncs should preserve the retry + cap + consuming-stream mapper behaviour rather than reintroducing silent projection drops.

Checks

• vp check (passes; existing lint warnings remain)
• vp run typecheck