discord_rest: guild_snapshot fails open on non-Discord errors (server-26#225 S2 review)

A Firestore error inside classification (dropping membership, marking a
token invalid) propagated out of guild_snapshot and, behind asyncio.shield,
could die unretrieved. S3's start_stream must fail open, so the snapshot
now returns UNKNOWN (cached briefly) and logs only the exception type.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/internal/discord_rest.py

@@ -639,7 +639,19 @@ async def guild_snapshot(token_doc: dict, guild_id: str, *, refresh: bool = Fals
     needed — and ``/guilds/{g}/channels``). ``refresh=True`` skips the cache
     (a concurrent load is still shared). Never raises for a Discord failure."""
     guild_id = str(guild_id)
-    key = (str(token_doc.get("token_id")), guild_id, "snapshot")
-    return await access_cache.get_or_load(
-        key, lambda: _load_snapshot(token_doc, guild_id),
-        lambda s: ttl_for(s.status), refresh=refresh)
+    token_id = str(token_doc.get("token_id"))
+    key = (token_id, guild_id, "snapshot")
+
+    async def _load() -> GuildSnapshot:
+        # Fail open on anything else too (a Firestore write inside the
+        # classification, a malformed body): the caller gets UNKNOWN, never
+        # an exception, and a shielded load never dies unretrieved.
+        try:
+            return await _load_snapshot(token_doc, guild_id)
+        except Exception as e:
+            logger.warning(f"Discord snapshot for bot {token_id} in {guild_id} failed: {type(e).__name__}")
+            return GuildSnapshot(token_id=token_id, guild_id=guild_id, status=UNKNOWN,
+                                 bot_user_id=token_doc.get("bot_user_id"),
+                                 error=f"check failed ({type(e).__name__})")
+
+    return await access_cache.get_or_load(key, _load, lambda s: ttl_for(s.status), refresh=refresh)