fix: converge concurrent organization handoff publishers under load

[apresmoi]

The flake

organizationHandoffAuthorityFsClient.test.ts — "converges full-size concurrent
publishers without leaving staging sidecars" — failed roughly one full-suite run
in six under load, blocking #8, #10 and #12.

Measured with the test run repeatedly under CPU load, arms interleaved within a
single load session so ambient drift hits both equally:

load	main	this branch
300 spinners / 18 cores	8 / 30 (27%)	0 / 30
400 spinners / 18 cores	7 / 40 (17.5%)	0 / 40
combined	15 / 70 (21%)	0 / 70

The test itself is unchanged — no loosened assertion, no retry wrapper, no skip.

The cause was not the attempt budget

The prior diagnosis pointed at the worker's PUBLICATION_*_ATTEMPTS budget.
Once the failures were made diagnosable, no failure was ever a budget
exhaustion. Two unrelated bugs were:

1. The liveness watchdog reaped the helper during its own startup.

setInterval(() => { if (!anchor || process.ppid !== anchor.parent_pid) process.exit(0); }, 100)

anchor is set at the end of an async startup path. On a loaded host that path
takes longer than one 100ms tick, so the watchdog exited the helper before it
could report ready — surfacing as exit=0 signal=null before the handshake.
The watchdog now reads the expected parent pid synchronously from the
environment, so it never depends on startup having finished. start still
validates the full anchor independently and no request is served until it does.

2. An unlinked staging sidecar was reported as a rejected election.

expectedElectionState ended with return stat?.nlink === 1, which maps "the
leaf is gone" to false (fail closed) rather than null (absent). The helper
that wins an election unlinks its sidecar immediately after linking the final
record, so a losing publisher can find it absent one syscall later — a benign,
converging race turned into a hard failure. Reachable by construction; not
observed as a trigger once (1) was fixed, so this is a correctness fix rather
than the flake's cause.

Diagnosability first

The failure was swallowed three times, not twice: the worker's queue .catch
dropped the reason and sent only ok: false; the client minted a fresh bare
Error; and the store's catch { return fail(); } replaced it again.

Failures now carry which budget or invariant failed, the attempt count, real
elapsed wall-clock against the limit, and the structural shape of the
contending state:

Organization handoff authority failed: settle_budget_exhausted (budget=settle
  attempts=0 elapsed=16ms limit=12ms
  state=final:nlink=1,size=30000,mode=600 pending:absent recovery:absent op=create)

The message keeps its historical prefix, so existing expectations hold. The
diagnostic reports shape only — never record bytes, leaf names, or paths — and
the store's public message stays uniform, carrying the detail on cause so it
reaches an operator log without widening what the CLI prints.

Budget shape

Replaced the attempt-counted budget with a wall-clock deadline, an attempt cap
as a secondary bound, and jittered exponential backoff — one budget per
request rather than one per loop.

The loops wait for a peer to finish writing and linking a record. That is a
wall-clock event, so counting attempts measures the wrong thing: the loop's
effective patience varies with load, and nested loops each got their own budget,
which bounded no level usefully — each was too impatient while their product was
effectively unbounded. The jitter matters too: eight symmetric publishers waking
on a fixed 2ms timer retry in lockstep and re-observe the same unfinished state.

The worker's 2s budget now sits inside the client's 5s request deadline, so a
worker failure is reported rather than replaced by a client timeout.

Tests

Both root causes are regression-locked, each verified to go red when the fix is
reverted:

• reaches readiness when startup is stalled past a liveness watchdog tick —
  holds the single libuv threadpool slot so the anchor lstat cannot complete
  before the watchdog ticks. Reverted, it fails with exit:0:null, the CI
  signature.
• reports absence when the winning publisher unlinks the sidecar mid-check —
  the election logic moved behind an injectable lstat so mid-race
  interleavings can be staged deterministically.

npm run build, npm run typecheck, npm test (3446 passing, coverage
thresholds met) and node check-boundaries.mjs all pass. Total branch coverage
is 90.04% both before and after this branch.