fix: address independent verification findings

Classify empty completions as transient per human ruling (fixes flaky
real-gateway smoke and prevents caching empty responses), rename the
factory injection parameter gate to breaker per the frozen design,
rewrite the probe-entry cleanup without except BaseException, declare
python-dotenv explicitly, add a mid-backoff cancellation test, and
record all implementation errata in the design and architecture docs.

src/polygateway/middleware/retry.py

@@ -154,11 +154,13 @@ class RetryMW:
             if permit is None:
                 reasons.setdefault(cand.name, "rate_limited")
                 continue
+            entry = None
             try:
                 entry = await self._breaker.try_enter(cand, uuid.uuid4().hex)
-            except BaseException:
-                await self._settle_and_release(permit, 0)
-                raise
+            finally:
+                # try_enter 未归还 entry(异常/取消)→ 释放已占 permit,不吞任何异常
+                if entry is None:
+                    await self._settle_and_release(permit, 0)
             if entry.allowed:
                 return (cand, permit, entry), gate_rejections
             gate_rejections += 1