PackQuarantine

Bounds staging retries for a single unusable pack.

A pack that cannot be staged fails identically on every attempt, and the stability watcher re-arms after each failed mix. Without a bound, one unreadable zip wedges resource pack delivery permanently: the merge never completes, and the log fills with the same failure forever.

After FAILURES_BEFORE_QUARANTINE consecutive failures the pack is dropped from the merge so the remaining packs can publish. This is a deliberate trade: an incomplete merge that works beats a complete merge that never ships, and the operator is told exactly which pack was dropped.

Records are keyed on the pack's path and a cheap size/mtime fingerprint, so repairing or replacing the file clears its record automatically and the pack rejoins the next merge with no admin action and no restart.