degradedStallClassFor defaults to Retryable with no sync test; degradedStallReasonFor panics on the mount daemon path

[khaliqgant]

Two P3 hardening items on the degraded-stall classifier added in #426. Neither is reachable today; both are cheap to close and both sit on the mount daemon path.

Line references are provisional against 407918b (tip of fix/delegated-credential-sdk-remint-0815, merged as c56c816).

1. Two hand-synced lists, no test enforcing the sync

degradedStallClassFor (cmd/relayfile-cli/main.go:1636-1651) switches on errors.Is against three sentinels and defaults to Retryable.

The set of sentinels it knows must stay in sync with isMountCredentialExpired. Nothing enforces that. Any future non-retryable sentinel added to isMountCredentialExpired but not to degradedStallClassFor silently falls through to Retryable and reinstates exactly the P1 this PR fixed — the operator is told "relayfile will retry" for a condition that no retry can clear.

The failure is silent: no compile error, no test failure, correct-looking output.

Fix: derive both from one table, or add a test that enumerates every sentinel isMountCredentialExpired recognises and asserts degradedStallClassFor gives each one an explicit (non-default) class. A new unclassified sentinel should turn that test red on the commit that introduces it.

2. degradedStallReasonFor panics in its default branch

Unreachable today — the classifier only ever produces the classes it handles. But it is a panic on the mount daemon path, so if the invariant is ever broken the daemon dies rather than degrading.

Fix: return the unknown-class string instead of panicking. Keep the invariant assertion in a test.

Definition of done

• A test that fails when a sentinel recognised by isMountCredentialExpired has no explicit class in degradedStallClassFor.
• degradedStallReasonFor returns rather than panics; a test covers the unknown-class input.

---

Found by the independent review of #426 (reviewer rf426-independent-review-0816, findings F2 and F3); filed by factory-lead. Not dispatched — no readiness label.