fix(wecom): end the inbox acceptance wait at its deadline (CHE-1842) [merge]

[congvc-bot-x99]

Status

Ready for human merge decision. Cross-lab review: ACCEPTED by x99-codex-luna at c6203d0d86041d1385b99f2459ac839659fa93bb (comment 01a14bbc-0762-7c20-bb05-ea110b121151), 0 current P0/P1. The original-test parent-red criterion is WAIVED by Cheese (Decision A, comment 01a14bac-76b0-7f24-93fc-d4d5a31e7ff2), not PASS. Agents do not merge.

Conditions

• Host: X99. Base: main at d4978e0c00b9a5f34f38e84d668f2728484a71fd.
• TestGetTaskChannelOrigin_RealSQL fails on this X99 database with column "task_kind" does not exist. It fails the same way on the parent build, so it is not caused by this change. CI runs migrations first.
• The original test TestTryDeliverInbox_FallbackAttemptDoesNotWaitAgain did NOT fail locally on X99 on the parent or on the head. Pinned baselines, one normal run each (go test -p 1 ./internal/integrations/wecom -run '^TestTryDeliverInbox_FallbackAttemptDoesNotWaitAgain$' -count=200 -race -v, go1.26.9, isolated clean clones, exit 0): parent d4978e0c00b9a5f34f38e84d668f2728484a71fd completed 200 attempts with 0 failures; head c6203d0d86041d1385b99f2459ac839659fa93bb completed 200 attempts with 0 failures. The raw receipts are in the attachment che1842-receipts.tgz on CHE-1841.
• Provenance limits. An earlier parent 200-attempt -race run (13:30 ICT, 17 Oct) was recovered from a session transcript. It recorded the parent SHA and an ok line, with no per-attempt count and no captured exit status. Two earlier head runs (13:44 ICT and 13:49 ICT) ran on uncommitted trees and recorded no SHA, so they are not used. The earlier stress attempts against the parent (200 under 112 CPU hogs, 100 pinned to one busy core, 100 under a 5% CPU quota, 1300 with the process paused 4ms of every 7ms: 1,700 attempts in total, all passing) have logs with no per-attempt lines, no commands and no source SHAs. This PR makes no aggregate claim from them.
• The original-test parent-red criterion is therefore not demonstrated. Cheese WAIVED it for this exact head (Decision A, comment 01a14bac-76b0-7f24-93fc-d4d5a31e7ff2): WAIVED, not PASS. The cause is derived from the CI failure message and the code, then pinned by a deterministic test. That test is a surrogate and does not satisfy the original-test parent-red criterion.

Change

confirmInbox polls the claim store on a step timer (window/8). The caller context keeps a backstop that expires window/8 + 1ms after the deadline. A step timer started just before the deadline ran a whole step past it. The margin to the backstop shrank to 1ms plus the distance of the last poll from the deadline. Under load, the backstop won the select, the verdict became relayUncertain, and the fallback bot was never offered the card.

CI evidence (run 39005239805, job backend-tests): tryDeliverInbox = false and "the recipient-wide bot was offered 0 frames, want 1" after 0.57s.

Fix, in server/internal/integrations/wecom/relay_outbound.go:

• The last wait is min(step, time.Until(deadline)), so the final poll lands at the deadline.
• The select waits on the caller context, not the backstop. A stall that expires both before the select runs no longer decides the verdict by pick order.
• A wait bounded by the caller deadline returns relayUncertain, because the wait now ends at that deadline before the context reports it.

No timeout was raised and no retry was added.

Evidence

• Commit 1 85f5e7c39162a92ac28b396d70eaadb44e59713a adds only a test. Its parent is d4978e0c00b9a5f34f38e84d668f2728484a71fd. On the parent that wall-clock test failed 18 of 20 runs. The independent review found it unsound: a late wake-up could skip the second poll and pass the regression.
• Commit 2 f2823e115800fe1056784ccff74113272a6e1fac holds the fix.
• Commit 3 c6203d0d86041d1385b99f2459ac839659fa93bb replaces the test with TestConfirmInbox_LastWaitDoesNotRunPastTheDeadline on a testing/synctest clock. Time is fake, so no sleep, scheduler delay or load changes the result. The test asserts exactly 2 polls, the first at the start, the last at exactly the 800ms deadline, and a return at exactly 800ms.
• Green on the fixed head: go test -p 1 ./internal/integrations/wecom -run '^TestConfirmInbox_LastWaitDoesNotRunPastTheDeadline$' -count=200 -race passed 200 of 200.
• Negative control: the same test with relay_outbound.go reverted to the parent source failed 200 of 200 ("the last acceptance poll ran at 898ms, want exactly the 800ms deadline").
• Package: -run 'TestRelayPublish_|TestTryDeliverInbox_|TestConfirmInbox_' -count=30 -race passed. Full package -p 1 -race -count=1: all pass except the task_kind database test named in Conditions.

Closes CHE-1842
Refs CHE-1841

Changelog: none