Problem

The #27 re-queue-on-failure fix re-queued on any non-2xx, including permanent 4xx. A batch the server keeps rejecting (e.g. 422) → re-queue → retry → 422 → re-queue forever. This wedged runner carl: infinite log upload failed (status 422), will re-queue, spinning job slots and hammering the server.

Fix

Classify each send: Ok (2xx) / Transient (5xx, 408, 429, network) / Permanent (other 4xx). flush re-queues Transient, drops Permanent (logged), and is done on Ok. No retry loop on permanent rejections.

Tests

• permanent_4xx_is_dropped_without_retry_or_loop — 422 sent exactly once, dropped (fails on old code, which loops).
• rate_limit_429_is_treated_as_transient — 429 retried to success, not dropped.
• The #27 transient-503-recovery test still passes (data not lost on transient failures).

149 tests pass; clippy -D warnings + fmt clean.

Closes #28. Complements anvil#338 (the server-side fix that stops emitting the 422 in the first place).