fix(mobile): preserve saved work after storage failures

[rynfar]

A failed storage read can be mistaken for an empty mobile draft/outbox, allowing later writes or attachment cleanup to destroy saved work. Propagate read/decode failures to those operations and retry failed debounced saves during the final flush, preserving saved work and new edits.

Adopts upstream #9710 (7839140e5e) while retaining Pylon's draft fields and environment ownership. Applies to iOS and Android with every provider and server connection; no native dependency or contract changes. Recorded as a partial upstream adoption.

Validation: 103 draft/outbox tests, mobile typecheck, formatting, and targeted lint pass. This changes persistence behavior without changing layout; no simulator or live state was used.

The durable implementation and review record is consolidated in companion #279.

Model: GPT-6 Astra. Harness: Codex.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+22 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+22 B (+0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.5 KiB	56.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−10 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+5 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−15 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.3 KiB	57.3 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: de8d090 · PR result: e638d20 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.