Preserve RAS request identity across first-attempt retry binding

[harrisbienn]

Outcome

Ensure a first-attempt RAS scenario worker result binds the exact retained request and can be authenticated by a subsequent governed retry.

This standalone package issue was discovered by the FloodForecast Increment 8 DeLoutre canary. It tracks harrisbienn/floodforecast#59 and parent harrisbienn/floodforecast#40; closing it must not close either FloodForecast issue.

Problem

RasScenarioWorker._validate_request() currently inserts retry = null into a request that omitted the optional retry object. The worker hashes that normalized object in result.request.sha256, while retry verification compares the result to the retained request JSON. The hashes differ even though all result-defining inputs are unchanged, so immutable attempt 2 fails with prior RAS result does not bind the prior request.

Scope

• Preserve omission of the optional retry field when it was absent from the request.
• Keep explicit retry requests normalized and authenticated as before.
• Add regression coverage proving a first-attempt result hash binds its retained request and the next retry accepts the preparation-only failure.
• Do not weaken immutable input comparison or failure classification checks.

Acceptance criteria

• A no-retry request validates without a synthetic retry field.
• A worker result SHA-256 binds the retained no-retry request JSON.
• A retry request authenticates the retained preparation-only failure.
• Targeted and full package tests pass.

Tracks harrisbienn/floodforecast#59.
Tracks harrisbienn/floodforecast#40.