Harden widget toast state + SDK error-status edge

[hynding]

From Sprint 0-1 reviews (widgets/sdk task review Minors + final review triage #7/#8), bundled as one hardening pass:

Widgets (packages/widgets):

• UnlockToast removal uses reference equality (x !== u) and key ${achievementId}-${unlockedAt} — same-millisecond or reused-payload unlocks can collide/remove prematurely
• BadgeCabinet keeps a stale list if a refetch-on-unlock fails (decide: keep-stale vs clear)
• vi.useRealTimers() in the test isn't in try/finally — fake timers can leak if an assertion throws

SDK (packages/sdk):

• On mixed failures (5xx then network error), the thrown PromoceanApiError carries the stale earlier 5xx status
• The exhausted-retries test asserts a message substring rather than instanceof PromoceanApiError + .status

[hynding]

Additions from the Sprint 2 final review (widget/SDK hardening pass):

• <Placement>: add a unit test for the isOfferDismissed() === true branch (currently covered only indirectly by the e2e reload assertion); consider a dev-mode console.warn inside the fail-silent catch paths (spec mandates silent-to-empty in production, but silent failures cost debugging time in development).
• safeHttpUrl fails closed on relative URLs (new URL without a base throws) — intentional for CMS-sourced creatives; document that creative URLs must be absolute http(s).
• SDK: document that imageUrl/ctaUrl are sanitized at the widget layer only — third-party consumers rendering raw SDK responses need their own scheme allowlist.