New silent fallback lane and arm_source telemetry for retried model turns

What

• A new "silent lane" fallback mechanism sits alongside the existing, user-visible refusal-fallback retry. It can be armed either by a remote config key (convolute_arcades) or by the server sending a response header (x-cc-tender-quilt: 1), which the client latches onto.
• When armed this way, retries are logged under differently-named, less descriptive telemetry events instead of the usual, plainly-named refusal-fallback events.
• Telemetry events, including the invalid-content-policy refusal event and tengu_api_success, now attach an arm_source field identifying which mechanism (config key or server header) armed the retry.
• tengu_api_success also gains a tender_quilt_header flag, set to true when a low-priority/background header condition is present.

Why

This lets Claude Code retry refused or failed turns through a quieter path when the server signals it should, while telemetry now records exactly which mechanism triggered the retry, which helps diagnose why a retry happened.