Context

The ingest_callback primitive added here is required for the
API-triggered sync HTTP endpoint
in controller-integrations to work — that endpoint pushes entities
outside the cron run() cycle and needs a callback to reach the
worker's Diode pipeline.

Summary

Extend worker.backend.Backend so that:

• __init__ accepts an ingest_callback keyword argument (optional,
  keyword-only, plus open **kwargs forward-compat door).
• A new worker.exceptions module exposes IngestError,
  IngestUnavailable, IngestRejected — raised by the ingest
  callback on pipeline failures.
• PolicyRunner.setup builds a per-policy ingest-callback closure and
  passes it to the backend constructor. The closure chunks+ingests
  entities mirroring run(), records each off-schedule emission as a
  pseudo-run in RunStore, and translates response/transport errors
  into the new exception subclasses.

PolicyRunner.run() is unchanged and remains single-shot per cron tick.

This unblocks API-triggered sync (INT-312, INT-386) and any future
integration pattern that needs to emit entities outside of the
single-shot run() cycle.

Design

Design doc:
worker-backend-ingest-callback.md
in netboxlabs/controller-integrations.

Compat

• Backwards-compatible. Older integrations (zero-arg __init__ or
  custom __init__ with **kwargs) continue working unchanged
  thanks to _construct_backend's inspect.signature introspection.
• Two integrations in controller-integrations define
  __init__(self) -> None and need a mechanical **kwargs edit
  before this minor reaches production: nbl-msft-dhcp,
  nbl-proxmox-ve. Follow-up ticket in that repo tracks the bump
  — does NOT block this PR (tests here mock the backend class).

Test plan

• worker/tests/test_exceptions.py — hierarchy (IngestError /
  IngestUnavailable / IngestRejected) catchable as base; messages
  preserved.
• worker/tests/test_backend.py — ingest_callback stored on the
  instance; zero-arg construction still works; unknown kwargs absorbed.
• worker/tests/policy/test_runner.py — setup passes
  ingest_callback to backend; callback happy path; error= path;
  TypeError when both or neither supplied; transport errors →
  IngestUnavailable; response errors → IngestRejected; large
  payloads chunked; the existing run() path remains unaffected.

Locally: cd worker && pip install -e ".[test]" && pytest → 109
passed, 0 failures.

Judgement calls

• _build_ingest_callback lives on PolicyRunner (not a standalone
  helper module) because the closure must capture self.run_store,
  self.metadata, and the diode client. Splitting it out adds
  plumbing without testability benefit — tests extract the closure
  via mock_backend_class.call_args.kwargs["ingest_callback"] and
  exercise it directly.
• Closure reads self._diode_client lazily so it can be built BEFORE
  the diode client (which needs metadata from backend.setup(),
  which needs the constructed backend). Solves the chicken-and-egg
  between "construct backend with callback" and "callback needs
  client".
• Error-mapping policy: response.errors non-empty → IngestRejected;
  any other transport exception → IngestUnavailable. Coarse but
  useful first cut; refinements remain additive.
• run_id kwarg from the integration is NOT honoured in v1 — the
  closure always creates a fresh pseudo-run. Documented as future
  open-kwarg evolution in the design doc.

Refs INT-386, INT-312.