Stop the autoSync daemon on a permanent mark-synced failure

[grimicorn-agent]

A permanent 403 on the PATCH leaves autoSync on, so the daemon re-attempts the same records forever; delete path already guards via deletePermanentlyFailed. (evidence: src/index.ts runDefaultSync mark-synced branch)

Acceptance criteria

• A permanent 403 on the PATCH leaves autoSync on, so the daemon re-attempts the same records forever; delete path already guards via deletePermanentlyFailed.
• Includes tests covering the change.
• Lint, tests, and CI green.

Promoted from improvement digest #132