fix(delivery): stop killing the fanout goroutine on a single send error

Closes S4 (AUDIT.md): Fanout.Run returned on the first sender error,
permanently ending notifications for the process lifetime after one ntfy
hiccup. Failed sends now go through an OnError hook and the loop
continues. Also persists the delivery cursor to a file next to
ORCHESTRA_DATA so a restart resumes from the last delivered event instead
of re-notifying the entire log from seq 0. Adds the package's first test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W1rkJ2hBMybnJctPbcy4tT

internal/delivery/delivery.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"orchestra/internal/domain"
 	"time"
@@ -101,23 +102,39 @@ type Fanout struct {
 	Senders []Sender
 	Cursor  uint64
 	Retry   time.Duration
+	// OnError is called for each failed send instead of aborting the fanout
+	// goroutine (S4, AUDIT.md: a single ntfy hiccup used to `return` and
+	// permanently kill notifications for the rest of the process). Defaults
+	// to log.Printf.
+	OnError func(err error)
+	// SaveCursor, if set, is called after the cursor advances past a
+	// processed event so a restart can resume from here instead of
+	// re-notifying the entire log from seq 0 (S4).
+	SaveCursor func(cursor uint64)
 }
 
 func (f *Fanout) Run(ctx context.Context, events func(uint64) []domain.Event) error {
 	if f.Retry <= 0 {
 		f.Retry = 5 * time.Second
 	}
+	onError := f.OnError
+	if onError == nil {
+		onError = func(err error) { log.Printf("delivery: %v", err) }
+	}
 	for {
 		for _, e := range events(f.Cursor) {
 			if msg, ok := Message(e); ok {
 				for _, s := range f.Senders {
 					if err := s.Send(ctx, msg); err != nil {
-						return err
+						onError(fmt.Errorf("send %s to %T: %w", msg, s, err))
 					}
 				}
 			}
 			if e.Seq > f.Cursor {
 				f.Cursor = e.Seq
+				if f.SaveCursor != nil {
+					f.SaveCursor(f.Cursor)
+				}
 			}
 		}
 		select {