fix(keyframes): expire cached probe failures so they can recover

[joepetjr]

Summary

probe_keyframes cached a failed probe for the life of the process. One transient ffprobe failure on unchanged media meant the re-encode fallback for good. A failed probe is now remembered for FAILED_PROBE_RETRY_SEC and then retried.

• Successful probes are still cached for the life of the process.
• The cache key still carries mtime and size, so a changed file is re-probed at once.
• Callers still get None on failure, the safe fallback. extract.py and cli.py are untouched.

Plan unit: KC-2 (portfolio remediation 2026-09-29).

Design decisions to review

• The retry window is 30 seconds. That number is a choice made here, not a measured value. It is a public constant so a caller can change it.
• Every None result gets the window: non-zero exit, missing ffprobe, timeout, and a clean exit with no keyframes. Transient and permanent failures are not told apart.

Test plan

• New TestFailedProbeRecovery in tests/test_keyframes.py, with a mocked clock: fail then succeed recovers after the window and the recovered result is cached; repeated failures inside the window run ffprobe once; a persistent failure re-probes at most once per window; a changed file is re-probed inside the window. All four were red before the change.
• Full suite locally: 139 passed. ruff check . clean.

Acceptance

• A probe that fails then succeeds for unchanged media recovers predictably: test_failure_then_success_recovers_after_the_retry_window.
• Repeated failures do not loop and keep the safe fallback: test_repeated_failures_inside_the_window_do_not_reprobe, test_persistent_failure_reprobes_at_most_once_per_window.
• Successful caching and file-identity invalidation are preserved: existing cache test plus test_changed_file_is_reprobed_inside_the_failure_window.

Not in this PR

• No version bump. The consumer pin needs a new tag first.