fix: retry queue preserves unattempted UUIDs across runs
When --limit cut a run short, a successful result would wipe the entire
retry queue — including UUIDs that were never attempted in that run.
Their attempts/firstFailedAt history was lost and they lost their
retry-first priority on the next run.
RetryQueue.merged now takes the attempted set. Prior entries whose UUID
isn't in that set are carried forward unchanged. Attempted UUIDs drop
(success) or merge (failure) as before. Unlimited `attic backup` runs
still clear the queue fully on full success, because `attempted` covers
the whole pending list.