fix(resilience): restore expired-connection retry-budget probe in health sweep

[jonlwheat2-gif]

What was broken

checkConnection() in src/lib/tokenHealthCheck.ts stopped probing expired GitHub connections that still have retry budget. The health sweep's terminal-skip guard treated such connections as terminal, so a transient OAuth failure could never self-heal.

Red evidence (before)

On release/v3.8.51 tip (and PR #11644's CI):

✖ checkConnection probes an expired GitHub connection that still has retry budget
  AssertionError [ERR_ASSERTION]: retry budget remaining — the sweep must probe so a transient failure can self-heal

The test (tests/unit/token-health-no-refresh-token-expired-5326.test.ts:217, pinned by #11592) creates a GitHub access-token-only connection with testStatus: "expired", errorCode: "invalid_grant", retry budget remaining, and asserts lastHealthCheckAt gets written (i.e. the sweep probes it).

Root cause

Two recent PRs contradicted each other:

• test(token-health): pin the real terminal-skip boundary, not the pre-exemption one #11592 deliberately rewrote the boundary: "an expired connection while it still has retry budget AND is not account_deactivated … only genuinely dead accounts stay unprobed." Its test pins the probing behavior.
• fix(ci): resolve inherited release/v3.8.51 base-red CI failures #11608 (a merge-batch conflict resolution) re-added a !isGitHubAccessTokenOnlyConnection(conn) carve-out to isRecoverableExpiredWithRetryBudget, resurrecting the old pre-exemption behavior that test(token-health): pin the real terminal-skip boundary, not the pre-exemption one #11592 explicitly deprecated.

Fix

src/lib/tokenHealthCheck.ts — remove the carve-out from isRecoverableExpiredWithRetryBudget (lines 599–602; 6 deleted lines):

  const isRecoverableExpiredWithRetryBudget =
    conn.testStatus === "expired" &&
    conn.lastErrorType !== "account_deactivated" &&
-    // GitHub access-token-only connections have their own dedicated exemption
-    // (isRecoverableGithubCopilotNoRefresh above): ONLY the exact
-    // "no_refresh_token" shape self-heals. An "expired" GitHub connection for a
-    // different reason (e.g. invalid_grant) is genuinely terminal and must stay
-    // skipped, otherwise the generic retry-budget exemption below reopens #8182's
-    // wasted-probe fix for every "expired" GitHub connection.
-    !isGitHubAccessTokenOnlyConnection(conn) &&
    getExpiredRetryCount(conn) < EXPIRED_RETRY_MAX;

The account_deactivated case — the actual #8182 wasted-probe guard — is still skipped and still covered by its own test (checkConnection still skips an expired GitHub connection whose account is deactivated (#8182)).

Green evidence (after)

ℹ tests 7
ℹ pass 7
ℹ fail 0

Full file: tests/unit/token-health-no-refresh-token-expired-5326.test.ts (all 7 tests, including both halves of the boundary).

Files changed

File	Change
src/lib/tokenHealthCheck.ts	lines 599–602: drop !isGitHubAccessTokenOnlyConnection carve-out
changelog.d/fixes/11592-token-health-retry-budget-boundary.md	new fragment

This fixes a base-red inherited failure on release/v3.8.51 (tracked in #11449) surfacing on PR #11644's CI.

[jonlwheat2-gif]

Superseded by consolidated PR #11679, which includes this fix alongside the other five failing-test root causes (per the requested PR organization: one PR for docs drifts #11673, one consolidated PR for all failing tests).