fix(stack): harden MergeStackEnvVars — in-tx deleting guard, lock_timeout, honest keys_set (panel #7)

[mastermanas805]

What (design-review follow-up to #235)

Three hardenings to the atomic env merge:

1. In-tx teardown guard (closes a TOCTOU). The "stack mid-teardown" check was a handler pre-read (stack.Status == deleting before the merge) — racy: the teardown worker can flip status between GetStackBySlug and the merge, committing an env change onto a deleting stack. The SELECT now fetches status under the FOR UPDATE lock and returns models.ErrStackDeleting (→ 409 stack_deleting); the handler pre-read is removed so the in-tx check is authoritative. Same posture as the resource-DELETE / SetTTL hardenings.
2. SET LOCAL lock_timeout = '3s' as the first tx statement — a PATCH racing a long-held row lock fails fast to a retryable 503 instead of hanging the request goroutine.
3. keys_set counts only actual upserts (v != ""). The old len(body.Env) - deletes over-counted a no-op delete (empty value for an absent key), making the rule-12 audit lie.

Coverage

Sites:          MergeStackEnvVars (model) + StackHandler.UpdateEnv
Coverage test:  TestMergeStackEnvVars_Branches rewritten for new SQL + adds lock_timeout-error
                and status='deleting'→ErrStackDeleting cases (MergeStackEnvVars 100%);
                existing real-DB deleting handler tests now exercise the in-tx path
Fault tests:    2 stack-env fault tests' failAfter bumped +1 (in-tx SET LOCAL exec is counted)
Live verified:  go test vs real Postgres+Redis; full ./...Stack suite green; all changed lines covered

🤖 Generated with Claude Code