Policy-helper failure tracking avoids duplicate tier-change announcements

What

• The policy helper (which manages settings pulled from a remote/managed source) now remembers the last failure code it saw and only announces a tier change when the failure changes, not every time it fails.
• apply() and retireState() reset the tracked failure (and reset selectedEntry when retiring).
• The mid-session re-check also announces a tier change when the failed config itself changes, not just when other conditions change.

Why Previously, a stuck policy-helper failure could re-trigger the "tier changed" announcement on every retry tick, creating noise. Now it fires once per distinct failure, giving a more accurate signal about when something actually changed.