MarkJobFailed

AutoManager writeback: record a durable terminal-failed verdict on the job (restart ceiling exceeded / bronze drop) so a poison job is not re-placed after a restart. Mirrors CompleteJob but sets the failure terminal state rather than completing cleanly.