[crisng95]

Account-safety follow-up to #67 / #74, on the current batch transport.

• Persistent hold. After PUBLIC_ERROR_UNUSUAL_ACTIVITY no generation is submitted for FLOW_UNUSUAL_ACTIVITY_COOLDOWN_S, now 3600s by default (was 120s). The hold is written to flow_generation_hold.json and restored on start, so restarting the agent no longer lifts it. A shorter hold never replaces a longer one or its reason. GET /api/flow/status → generation_throttle.cooldown_reason shows it.
• Bounded hijack retries. [HIJACK] extension_hijack_detected used to be requeued forever without counting. It now fails once the request's retry_count reaches 3 (the count is shared with other retries, so it can only stop sooner).
• Every unusual_activity spelling is terminal. A bare code no longer falls into the 10× reCAPTCHA retry loop.
• POST /api/flow/clear-hijack lifts the hold including the file. /fk-doctor documents both errors and says to lift the hold only once manual generation in the Flow UI works.

This takes the persistent-hold and bounded-retry ideas from #68 (thanks @raducupreda-art). #68 itself conflicts with main after the Flow move and makes generation opt-in; that broader gating is left for separate discussion.

Test plan:

• pytest -q tests: 480 passed, 2 skipped (8 new tests: hold survives a restart, expired/corrupt file ignored, clear removes the file, hijack sets a short hold, shorter hold keeps the longer one's reason, hijack retries counted then FAILED, bare UNUSUAL_ACTIVITY terminal)
• Direct run with the real config wiring: unusual-activity → file written → new FlowClient returns 429 with no submit → clear-hijack removes the file
• Not exercised against live Flow: that would mean deliberately triggering the block

🤖 Generated with Claude Code