fix(cli): retry transient gateway errors from the Checkly API [RED-861] [ship]

[sorccu]

Linear: RED-861

What

Adds bounded, backoff-based retries for transient upstream errors to the CLI's axios REST layer, so one-off gateway blips (e.g. a single 502) no longer fail deploy/test/trigger runs — or our e2e CI — outright.

• New packages/cli/src/rest/retry.ts: a retry rejection-handler registered as the first response interceptor on the shared instance (before the error-mapping interceptor), re-dispatching api.request(error.config) so the request interceptor refreshes auth headers on each attempt.
• Retried (GET/HEAD/OPTIONS automatically): 502/503/504 (Retry-After used when ≤ 10 s, else jittered backoff), 429 (Retry-After ≤ 10 s honored; > 10 s → no retry; absent → backoff), and no-response network errors (ECONNRESET, ETIMEDOUT, ECONNABORTED, EAI_AGAIN, ERR_NETWORK, EPIPE).
• Never retried: 408 (long-poll callers own that cadence), plain 500 (often deterministic), aborted/canceled requests, stream responses (deploy-progress SSE), and stream request bodies (single-use gzip payloads).
• Mutations can opt in per request via a new checklyRetry: true config flag where the endpoint is known idempotent; no endpoints are opted in yet (mechanism only).
• Policy: 3 total attempts, full-jitter exponential backoff (base 250 ms, backoff delay cap 2 s); an explicit server Retry-After is trusted for longer, up to 10 s per delay. Each retry emits a checkly:cli:rest:retry debug line (DEBUG=checkly:cli:rest*).
• The backoff timer stays ref'd while a caller awaits the retry (so the process can't exit mid-backoff) and is cancelled immediately if the request's abort signal fires (so an abandoned retry can't hold the process open).

Testing

• 22 new unit tests covering the retry policy matrix, Retry-After parsing, abort behavior, stream guards, and the production interceptor wiring/order.
• Verified end-to-end against a local always-502 server: the CLI makes 3 attempts, logs both retry lines, surfaces ServerError, exits 1; aborting mid-backoff settles immediately instead of waiting out the delay.

Known limitations

• checkly api sets validateStatus: () => true, so it never rejects and never retries (raw passthrough semantics).
• The login flow builds its own interceptor-less axios instances and is not covered.
• deploy/test submit requests can never retry (single-use gzip stream bodies); opting in plain-JSON mutations (e.g. env add, trigger) is a candidate follow-up.

🤖 Generated with Claude Code

[github-actions]

Auto-approved: ship/show PR from a same-repo branch.