fix(daemon): measure attention window from failure

Closes the gap #239 describes: §5.7's 30-day window was filtered on
grabbed_at, so a torrent stalling past the window before hard-failing
at import never surfaced in the needs-a-decision queue. grabs gains
failed_at (migration 0030, backfilled from grabbed_at for existing
failed rows), the import tick stamps it on hard fail, and every window
query in the daemon notifier and the attention endpoint reads it.
§5.7 now states the anchor explicitly. §6.2's pack backoff stays on
grabbed_at deliberately; noted on the issue.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DESIGN.md

@@ -385,6 +385,13 @@ happened within the last 30 days. One bad torrent is not a decision — a
 release that hard-failed is blacklisted (§6.3) and the next candidate is
 grabbed, which is the system working.
 
+The window runs from the failure, not the grab. The two are usually minutes
+apart, but a torrent can sit stalling on a dead swarm for five weeks before
+`ffprobe` finally condemns it — and that failure is fresh evidence the target
+is broken now, not history. Measured from the grab it would be born outside
+the window and a genuinely broken target could never surface. So `grabs`
+records `failed_at` alongside `grabbed_at`, and the window reads it.
+
 The window is what lets the queue be emptied. Nothing clears a `grabs` row, so
 without it the queue only ever grows and the one season that wants attention
 sits behind eight that were dealt with months ago. It is the queue's version of