fix(startup): lead the damaged-store screen with the repair, not retry

A reporter on #1732 ran three successive builds against a preference store of
10336 bytes, every one of them zero, and reported each as "still failing". The
gate classified it correctly every time and the consented repair would have
cleared it in-process, but nothing on the failure screen said so: Retry was
first, styled `FilledButton`, and autofocused, while `Repair storage` sat beside
it as a tonal afterthought. Retry re-reads the same document, so for a
corrupt-store failure it is an action that cannot succeed however many times it
is pressed — and it was the one the screen recommended.

Repair now takes the primary styling, the focus node and first position whenever
it is offered, and the body text says plainly that retrying will not help.
Retry keeps its place for every other failure, where a locked database or a
denied directory really can change between attempts.

The consent dialog was also promising an outcome it could not always deliver.
Servers and profiles survive a repair only because their tokens are ciphertext
in the database and the key that decrypts them lives in the store, so a store
the key cannot be read out of signs the user out of everything — exactly the
all-zero case. `PrefsRecovery.previewSalvage` reads the damaged file without
touching it, and the dialog now names the real cost from that. The retained copy is
labelled as holding credentials unless the bytes prove otherwise: what the
salvage recovered says nothing about what the file still contains, because a
store truncated mid-value keeps most of a vault key in plaintext while the
salvage pattern — which needs the value's closing quote — matches nothing at
all. Only an all-zero file drops the warning, so the one case that cries wolf
is the one that provably holds no secret.

`describe()` finally carries whether a repair was on offer. That line is the
difference between a report a maintainer can act on and two days of guessing
whether the button was even on screen.

close #1732

lib/widgets/startup_failure_view.dart

@@ -69,13 +69,15 @@ class StartupFailureView extends StatefulWidget {
 }
 
 class _StartupFailureViewState extends State<StartupFailureView> {
-  late final FocusNode _retryFocusNode = FocusNode(debugLabel: 'startup-failure-retry');
+  /// Holds whichever action leads this screen — Repair when it is offered,
+  /// Retry otherwise, Quit once a restart is owed.
+  late final FocusNode _primaryFocusNode = FocusNode(debugLabel: 'startup-failure-primary');
   bool _detailsExpanded = false;
   bool _uploading = false;
 
   @override
   void dispose() {
-    _retryFocusNode.dispose();
+    _primaryFocusNode.dispose();
     super.dispose();
   }
 
@@ -162,7 +164,11 @@ class _StartupFailureViewState extends State<StartupFailureView> {
               ),
               const SizedBox(height: 8),
               Text(
-                restartRequired ? t.startup.restartRequiredBody : t.startup.failedBody,
+                restartRequired
+                    ? t.startup.restartRequiredBody
+                    : repair != null
+                    ? t.startup.failedBodyRepairable
+                    : t.startup.failedBody,
                 key: restartRequired ? startupFailureRestartKey : null,
                 style: theme.textTheme.bodyMedium,
                 textAlign: TextAlign.center,
@@ -181,29 +187,45 @@ class _StartupFailureViewState extends State<StartupFailureView> {
                 spacing: 12,
                 runSpacing: 12,
                 children: [
-                  if (!restartRequired)
-                    FocusableButton(
-                      focusNode: _retryFocusNode,
-                      autofocus: true,
-                      onPressed: canAct ? widget.onRetry : null,
-                      child: FilledButton(
-                        key: startupBootstrapRetryKey,
-                        onPressed: canAct ? widget.onRetry : null,
-                        child: Text(t.common.retry),
-                      ),
-                    ),
+                  // Repair leads whenever it is offered. The failure it
+                  // addresses is a document on disk that Retry re-reads
+                  // unchanged, so Retry cannot clear it however many times it
+                  // is pressed — and it used to be the primary, autofocused,
+                  // first-in-order action, which is what a reporter on #1732
+                  // pressed repeatedly before concluding the fix had not
+                  // shipped. Retry keeps its place for every other failure,
+                  // where the environment really can change between attempts.
                   if (!restartRequired && repair != null)
                     FocusableButton(
+                      focusNode: _primaryFocusNode,
+                      autofocus: true,
                       onPressed: canAct ? () => repair() : null,
-                      child: FilledButton.tonal(
+                      child: FilledButton(
                         key: startupFailureRepairKey,
                         onPressed: canAct ? () => repair() : null,
                         child: Text(t.startup.repairStorage),
                       ),
                     ),
+                  if (!restartRequired)
+                    FocusableButton(
+                      focusNode: repair == null ? _primaryFocusNode : null,
+                      autofocus: repair == null,
+                      onPressed: canAct ? widget.onRetry : null,
+                      child: repair == null
+                          ? FilledButton(
+                              key: startupBootstrapRetryKey,
+                              onPressed: canAct ? widget.onRetry : null,
+                              child: Text(t.common.retry),
+                            )
+                          : OutlinedButton(
+                              key: startupBootstrapRetryKey,
+                              onPressed: canAct ? widget.onRetry : null,
+                              child: Text(t.common.retry),
+                            ),
+                    ),
                   if (restartRequired && PlatformDetector.isDesktopOS())
                     FocusableButton(
-                      focusNode: _retryFocusNode,
+                      focusNode: _primaryFocusNode,
                       autofocus: true,
                       onPressed: enabled ? _quit : null,
                       child: FilledButton(