fix(engine): retry on 429 instead of a false SKIP, and correct the call count

Measured 2026-08-04: 13 script invocations in one shell loop tripped an
anonymous Forgejo rate limit at 26 requests, because each invocation makes
TWO calls (org listing + catalog marketplace.json), not the ONE this repo's
own CLAUDE.md claimed. That line went stale when INSTALL-TRUTH added the
second call and nobody updated the count it depended on.

fetchWithRetry wraps both calls, honoring Retry-After on HTTP 429 instead of
silently falling back to SKIP. TDD: 5 new tests inject a fake fetch and sleep
to drive the retry/backoff/give-up paths without touching the network.

A sweep across every repo still doesn't belong in this engine — that's
org-ops's job by this file's own header — but a single repo's self-check
should not read as broken just because the forge was briefly busy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01496ZWasKPnA627crFBXWhe

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning is [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.1] — 2026-08-04
+
+### Fixed
+
+- The gate makes two anonymous forge calls per invocation (org listing +
+  catalog `marketplace.json`), not one — this repo's own `CLAUDE.md` said
+  "one" from before `INSTALL-TRUTH` added the second, and stayed wrong long
+  enough that a 13-repo shell loop trusted the count and tripped an HTTP 429
+  at 26 requests. Both calls now go through `fetchWithRetry`, which honors
+  `Retry-After` and retries instead of silently reporting `SKIP` on a
+  transient rate limit. `CLAUDE.md` corrected to match.
+
 ## [0.2.0] — 2026-08-04
 
 ### Added