[kean]

Opt-in failureCooldown: after a 404 or 410, the pipeline stops requesting that URL for a while, so a dead image in a feed doesn't cost a request per cell. The plan had cut this, and it's back by request. Loads fail with the new .urlInCooldown(error:), after the caches and before the queue; ImageLoader.reload() and .skipFailureCooldown still reach the server.

Proof

• With the check disabled, which is what main does, 13 of the new tests fail (loadWithinTheWindowMakesNoRequest and others) and aURLInCooldownDoesNotWaitForTheQueue hangs. 8 other mutations (no expiry, any status code, no bypass, unbounded, ...) are each caught.
• Nuke 1795 macOS / 1843 iOS 27 / 1840 tvOS 27, NukeUI 638 / 648 / 648. The only failures are in ImagePipelinePreviewPolicyTests, which fails the same way on base in a full local run, and passes 14/14 alone on both.
• Off, a download pays one load and branch at each of 2 sites (disassembly). The whole-process count can't resolve that: branch +2.7% vs A/A +2.2% at load 140.
• Gaps: .reload(id:) in Add reload, keepsPreviousImage, failureView, and imageTransition to LazyImage #1100 calls load, so it needs the same bypass as reload(), and Add retries to the pipeline #1072 must record the failure after its last retry. Xcode 26.0 is CI only.