discord_rest: guild_snapshot fails open on non-Discord errors (server-26#225 S2 review)

A Firestore error inside classification (dropping membership, marking a
token invalid) propagated out of guild_snapshot and, behind asyncio.shield,
could die unretrieved. S3's start_stream must fail open, so the snapshot
now returns UNKNOWN (cached briefly) and logs only the exception type.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/tests/test_discord_rest.py

@@ -334,6 +334,21 @@ async def test_missing_access_alone_never_changes_membership(discord, fs):
     assert snap.status == rest.UNKNOWN and fs.get("bot_tokens", "t1")["guild_ids"] == [G]
 
 
+async def test_non_discord_failure_is_unknown_not_raised(discord, fs, monkeypatch):
+    # A Firestore error while classifying (here: dropping membership) must
+    # fail open — S3's start_stream relies on the snapshot never raising.
+    _guild_routes(discord)
+    discord.routes[("GET", f"/guilds/{G}")] = httpx.Response(404, json={"code": 10004})
+    tok = _token_doc(fs)
+
+    async def _boom(*a, **kw):
+        raise RuntimeError("firestore down")
+    monkeypatch.setattr(rest, "_drop_membership", _boom)
+    snap = await rest.guild_snapshot(tok, G)
+    assert snap.status == rest.UNKNOWN and "RuntimeError" in snap.error
+    assert TOKEN not in snap.error
+
+
 async def test_unknown_result_is_cached_briefly(discord, fs):
     discord.routes[("GET", f"/guilds/{G}")] = httpx.Response(503)
     tok = _token_doc(fs)