R8 re-review M2. `_retired()` read any OSError/ValueError as "nothing retired": while the list
was unreadable (a Windows sharing violation, an AV scanner) a completed obligation came back into
`orphans()`, `claim()` took it, and a retirement made in that window rewrote the list with only
its own ids, erasing the history for good.
- Only an absent list is empty. One that exists but cannot be read (or is malformed) raises
`RetiredUnknown`: `orphans()` reports it (recovery prints the skip), `claim()` takes nothing,
`_retire()` raises before rewriting the list or deleting a carrier.
- `orphans()` surveys under the pause mutex, so it no longer reads the list while a mutator
replaces it (Windows opens without FILE_SHARE_DELETE).
- `hermes update` aborts before its first stop with a clear message when it cannot read what an
earlier update paused, instead of adopting from an unknown list.
- `_mutex()` takes an optional wait (used by the planned-stop consumer in a later commit).
Test: test_an_unreadable_retired_list_claims_nothing_and_forgets_nothing (real file, mode 000 as
the stand-in for a Windows read refusal) — RED on 13017670871, GREEN here.
(cherry picked from commit 08ce58ae672457def25deb5e7f775f5166fa7eaf)
b29247ef8b