facade: retry on a live file only the failures libhdf5's SWMR reader retries

is_transient_format counted every format error but a handful as transient,
so on an open_swmr handle a permanent failure (a file that is not HDF5, an
unsupported version or message, a truncated file) was retried 100 times,
about 0.9 s of pauses per failing operation. Now only these are retried:
a checksum mismatch; a read past the file's current end (UnexpectedEof;
libhdf5 reads zeros there, which fail the checksum); and an object header
prefix whose signature or version does not decode, which libhdf5's
H5C__load_entry also retries (a header garbled whole fails there before its
checksum). Everything else is returned at once.

Tests: a unit test that every permanent kind returns after one call within
50 ms and every transient kind is retried to the limit; open_storage_swmr
of a non-HDF5 buffer returns SignatureNotFound within 100 ms (0.87 s before)
and a missing name on a live file fails without retries. The torn-read and
live h5py-writer tests still pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

CHANGELOG.md

@@ -36,14 +36,16 @@ Design: `docs/design/swmr.md`.
   see the writer's appends; a handle keeps its extent until refreshed.
 - **Bounded retries.** On a SWMR-read file, an operation (open, lookups,
   refresh, reads) that fails with an error a concurrent write can cause —
-  any format error except a wrong name or selection, an unsupported
-  feature or a bad argument — is run again from the start, up to
+  the failures libhdf5's SWMR reader retries: a checksum mismatch, a read
+  past the file's current end, an object header prefix that does not
+  decode — is run again from the start, up to
   `File::swmr_read_attempts()` times (`SWMR_READ_ATTEMPTS` = 100,
   libhdf5's default metadata read attempts for SWMR readers,
   `H5Pset_metadata_read_attempts`; `set_swmr_read_attempts` changes it),
   pausing 1 µs doubling to 10 ms between attempts. Results come only from
   an attempt in which every structure verified, so a torn read is at worst
-  an error, never data. `File::swmr_retries()` counts the retries.
+  an error, never data. Any other error is returned at once.
+  `File::swmr_retries()` counts the retries.
   `File::swmr_writer_active()` reads the superblock flags again to tell
   when the writer has closed the file.
 - Tests (`crates/clawhdf5/tests/swmr_interop.rs`): the mid-write copy