fix: guard against ambiguous food write retries

[milldr]

Summary

• Disable automatic browser SDK transport retries so a lost response cannot silently replay a non-idempotent operation.
• Warn before quick-add that progress or a tool timeout is not failure; report write errors as unconfirmed and require checking all macro rows before any retry.
• Return explicit [] for valid empty servings JSON, reject missing export headers, and send machine-mode export errors to stderr with a nonzero exit status.
• Document baseline comparison, process/session polling, and partial-write handling.

Incident analysis

The earlier agent launched quick-add twice after receiving only 30 seconds of progress output. Its execution wrapper returned only output and discarded process/session metadata. It inspected the diary before establishing that the original write had finished, then incorrectly treated absence as a completed failure. The user confirmed both writes ultimately saved. This primarily requires an agent/prompt fix; SDK retries and ambiguous empty export output are additional code-level risks, not proven causes of this incident. Companion Promptr branch: tembo/safe-crono-verification.

Validation

• 243 tests pass, including pending-write, ambiguous failure, SDK retry configuration, quick-add row parsing, and empty/invalid export regressions.
• npm run build and npm run lint pass.
• Changed TypeScript files pass Prettier; git diff --check passes.
• Tests run with KERNEL_API_KEY, CRONO_CRONOMETER_USERNAME, and CRONO_CRONOMETER_PASSWORD unset to isolate credential fixtures from the sandbox environment.
• No live food writes or diary edits performed.

Want tembo to make any changes? Add a comment with @tembo and i'll get back to work!