facade: retry on a live file only the failures libhdf5's SWMR reader retries

is_transient_format counted every format error but a handful as transient,
so on an open_swmr handle a permanent failure (a file that is not HDF5, an
unsupported version or message, a truncated file) was retried 100 times,
about 0.9 s of pauses per failing operation. Now only these are retried:
a checksum mismatch; a read past the file's current end (UnexpectedEof;
libhdf5 reads zeros there, which fail the checksum); and an object header
prefix whose signature or version does not decode, which libhdf5's
H5C__load_entry also retries (a header garbled whole fails there before its
checksum). Everything else is returned at once.

Tests: a unit test that every permanent kind returns after one call within
50 ms and every transient kind is retried to the limit; open_storage_swmr
of a non-HDF5 buffer returns SignatureNotFound within 100 ms (0.87 s before)
and a missing name on a live file fails without retries. The torn-read and
live h5py-writer tests still pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/design/swmr.md

@@ -103,14 +103,16 @@ writer keeps appending. What the format and the library guarantee:
    it), sleeping 1 µs, 2 µs, … up to 10 ms between attempts (under a second
    in all). libhdf5 retries the one structure whose checksum failed; we
    retry the whole operation, because the parsers are pure functions of the
-   bytes they read. Which errors: a garbled read can fail whichever check
-   the parser makes first — a checksum, a signature, a version byte, a
-   size (a test that garbles every byte of a header got
-   `InvalidObjectHeaderVersion`, not a checksum error) — so every format
-   error counts except those later bytes cannot change: a path or selection
-   the caller got wrong, an unsupported filter or external storage, a bad
-   argument. Those, and a live file's permanent errors of the other kinds
-   after the last attempt, are returned; non-live files never retry.
+   bytes they read. Which errors: those libhdf5 retries (`H5C__load_entry`)
+   — a checksum mismatch, and a failure to decode the prefix it reads
+   before the checksum to size the structure (for an object header its
+   signature and version: a test that garbles every byte of a header gets
+   `InvalidObjectHeaderVersion`) — and a read past the file's current end
+   (short here; libhdf5 reads zeros there, which fail the checksum). Every
+   other error (an unsupported version or message, a file that is not HDF5,
+   a structure corrupt behind a valid checksum) is returned at once: an
+   earlier version retried nearly every format error, so a permanent one
+   cost about 0.9 s of pauses. Non-live files never retry.
    Results are only returned from a run where every structure verified, so
    a torn metadata read is an error, never data. `File::swmr_retries()`
    counts the retries (libhdf5: `H5Fget_metadata_read_retry_info`).