feat(ariadne): allowlist the transient-infra retry action

The classification->action registry already mapped transient_infra_failure to
retry_transient_infra, but the action allowlist held only repair_demo_fixture,
so that route always died at the action_not_allowlisted gate. Add the action
and state the registry explicitly rather than relying on the code default.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/maintenance/apps/ariadne-deployment.yaml

@@ -465,7 +465,13 @@ spec:
             - name: ARIADNE_HERMES_AUTOREMEDIATION_ENABLED
               value: "true"
             - name: ARIADNE_HERMES_ALLOWED_ACTIONS
-              value: repair_demo_fixture
+              value: repair_demo_fixture,retry_transient_infra
+            # Each classification maps to exactly one action id. A diagnosis
+            # whose classification is absent here can never reach an action,
+            # and a diagnosis asking for an action that is not its
+            # classification's own is refused before anything runs.
+            - name: ARIADNE_HERMES_ACTION_CLASSIFICATIONS
+              value: known_demo_fixture_failure=repair_demo_fixture,transient_infra_failure=retry_transient_infra
             - name: ARIADNE_HERMES_MIN_CONFIDENCE
               value: "0.85"
             - name: ARIADNE_HERMES_MAX_ACTIONS_PER_INCIDENT