test: MaxRestarts saturation freezes role permanently until delete+re-apply

[arcaven]

What to test

PR #21 added the max_restarts cap. When the count is reached, noteCrashAndBackoff sets BackoffUntil = saturationFreezeUntil (far future) and the reconciler's gate refuses spawns forever. PR #33 fixed #29 so delete+re-apply clears that saturation state.

Test plan

1. Apply:

workspace:
  name: saturation-test
teams:
  - name: doomed
    roles:
      - name: exit-fast
        replicas: 1
        max_restarts: 3
        runtime:
          command: sh
          args: ["-c", "exit 1"]
        restart_policy: always

2. Watch marvel events until restart chore(deps): bump go.opentelemetry.io/otel/metric from 1.42.0 to 1.43.0 #3 (wall time: 30s + 60s + 120s ≈ 3.5 min).
3. Wait an additional 10 minutes. No restart should fire.
4. marvel describe team saturation-test/doomed — verify RoleHealth.BackoffUntil is far-future.
5. marvel delete workspace saturation-test.
6. Re-apply the same manifest.
7. Expect a fresh session.created event within one reconcile tick, not a 10+ minute delay.

Pass

• Exactly 3 restart attempts before saturation. No 4th spawn even after hours of idle.
• describe team surfaces a far-future BackoffUntil.
• After delete + re-apply, a new session spawns within one reconcile tick.
• No stale SessionCrashed marker from the prior generation visible in get sessions.

Fail

• 4th restart attempted.
• BackoffUntil not visible in describe team.
• Delete + re-apply stalls — would indicate PR fix(team): clear RoleHealth on workspace/team cascade delete #33 didn't plumb all the state clearing correctly.

Related: PR #21, PR #33.

[arcavenai]

Blocked by #28 on alpha-20260419.034700.20d90ac.

Applied the test manifest verbatim:

roles:
  - name: exit-fast
    replicas: 1
    max_restarts: 3       # ← specified here
    runtime: {...}
    restart_policy: always

Immediately after apply:

$ marvel describe team saturation-test/doomed | jq '.Roles[0].MaxRestarts'
0

The YAML field is silently dropped at the ManifestRole → Role conversion — same root cause as #28 and #43. With MaxRestarts=0 (unlimited in the current semantic), saturation can never be reached, so the "3 restart cap → freeze → delete+re-apply unblocks" flow can't be exercised on this build.

Will re-run this test once #28 (and the sibling #43) land — both will be fixed together by adding DangerousPermissions and MaxRestarts to ManifestRole and plumbing the copy in manifest.go.

Leaving this test open as blocked.