fix(tenant): finalize definitive/manual-retry publish tasks as failed

Add normalizeDesktopTaskCompletionStatusForTask so an "unknown" publish
completion is downgraded to "failed" when the payload is a manual retry or
the error matches a definitive publish failure, instead of leaving it
stuck as unknown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_task_service.go

@@ -1217,7 +1217,7 @@ func (s *DesktopTaskService) Complete(ctx context.Context, client *repository.De
 	previousTask, _ := taskRepo.GetByDesktopID(ctx, desktopID, client.WorkspaceID)
 	previousAttemptID := activeAttemptID(previousTask)
 	if previousTask != nil {
-		finalStatus = normalizeDesktopTaskCompletionStatusForKind(previousTask.Kind, finalStatus)
+		finalStatus = normalizeDesktopTaskCompletionStatusForTask(previousTask.Kind, finalStatus, previousTask.Payload, errorJSON)
 	}
 
 	task, err := taskRepo.Complete(ctx, desktopID, HashDesktopClientToken(strings.TrimSpace(req.LeaseToken)), finalStatus, resultJSON, errorJSON)
@@ -1937,6 +1937,24 @@ func normalizeDesktopTaskCompletionStatusForKind(kind string, status string) str
 	return strings.TrimSpace(status)
 }
 
+func normalizeDesktopTaskCompletionStatusForTask(kind string, status string, payloadJSON []byte, errorJSON []byte) string {
+	normalizedStatus := normalizeDesktopTaskCompletionStatusForKind(kind, status)
+	if strings.TrimSpace(kind) != "publish" || normalizedStatus != "unknown" {
+		return normalizedStatus
+	}
+	if boolValueFromMap(unmarshalJSONObject(payloadJSON), "manual_retry") {
+		return "failed"
+	}
+	if publishUnknownTaskHasDefinitiveFailure(&repository.DesktopTask{
+		Kind:   "publish",
+		Status: "unknown",
+		Error:  errorJSON,
+	}) {
+		return "failed"
+	}
+	return normalizedStatus
+}
+
 func normalizeDesktopTaskViewStatus(kind string, status string) string {
 	switch strings.TrimSpace(kind) {
 	case "monitor":