Root cause of the GerSch failure: the click's AppArmor policy had no
policy groups, so the confined app could not use the network (no
nameservice, no sockets) and every name lookup failed with "temporary
failure in name resolution" while the shell resolved fine. Add the
networking group.

Queue: a download gives up after Options::max_retries failed requests in
a row (bytes arriving reset the count), so the task is marked failed and
the next one starts. Cancel for queued, running and failed items, and
Cancel all; a cancel deletes the row first, then the partial files, and
files left by a kill are swept at the next start. A waiting backoff is
woken by a command, so a cancel is prompt. Retry per row. e2e cases for
a failing source and for cancel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -192,3 +197,4 @@
     /// Queues a command and returns its number (increasing from 1).
     pub fn send(&mut self, command: Command) -> u64 {
         self.next += 1;
+        self.wake.store(true, Ordering::Relaxed);

@@ -287,2 +303,4 @@
                     // Whatever arrived before the error is kept.
                     self.off = self.part.metadata()?.len();
+                    failures = if self.off > before { 1 } else { failures + 1 };
+                    if failures >= self.c.opts.max_retries {