[akonwi]

Makes the macOS test job deterministic. Fixes #234 and #256.

Root causes

CI diagnostics (temporary instrumentation, since dropped) on the 3-core macos-latest runner showed:

1. Saturated executors at suite start. Swift Testing starts ~970 tests at once. The main actor was blocked for 6.2 s in one stretch, and the cooperative pool for up to 2.7 s. Tests that gave a condition a 0.5–5 s budget failed on correct code:
   • TileArrangementTests.layoutChangesAreCapturedAfterADelay: its first capture was still pending after 6.2 s (Flaky macOS CI tests: SessionLauncherTests.renderLauncherForReview and TileArrangementTests #234).
   • SSHHostTests.closingAHostWithdrawsItsQuestion: the first question took 4–5 s to arrive (Flaky: SSHHostTests.closingAHostWithdrawsItsQuestion is timing-dependent #256). SSHServerConnectionTests failed the same way in one diagnostic run.
2. A shared SwiftUI field editor. SwiftUI edits every text field in the process with one field editor. When another test focused a text field in its own window, it took that editor, and the launcher's window became its own first responder. The diagnostics showed the search field gaining focus and then losing it about 120 ms later. Focus never came back, even after 145 s. The arrow keys and Return then went nowhere (opened == [], renamed == ["a"]). This explains the consistent renderLauncherForReview failures (Flaky macOS CI tests: SessionLauncherTests.renderLauncherForReview and TileArrangementTests #234). Adding windowed tests such as fix(macos): shrink and scroll tile tabs without a system scroller #254's makes the overlap more likely. Opening a second focused window reproduces it locally every time. Activation and key-window status don't matter: the app was never active on CI, and focus works without either.

Fixes

• eventually (TestTiming.swift): one polling helper whose 60 s limit only stops a broken build from hanging. It replaces every short-budget polling loop and ad-hoc until/eventually/wait helper (about 60 call sites). Tests that pressed a key a fixed number of times, or after a fixed sleep, now press until they see the effect.
• Injected debounce sleeps: SessionWindowModel and ScratchpadState take a Sleeper. With ManualSleeper, the layout-capture and autosave tests wait for the delay to start, check that nothing happened yet, end the delay, and check the result. They no longer measure wall-clock time; they assert which delay was requested.
• Windowed tests wait for rendered state: the diff, inline annotation, and transcript history tests slept a fixed 150–1500 ms between steps. They now wait for the layout, scroll, or focus state they assert on. diffPaneShowsServerFileAndTargetInBothAppearances had failed on CI because of these sleeps.
• FocusIsolatedWindow (TestWindows.swift): edits with its own instance of SwiftUI's field editor. The launcher test uses it, and no longer calls NSApp.activate() or makeKey().
• The SSH fakes keep the app's own ssh idle timeout (30 s) instead of 5 s. No test waits that timeout out, and the shorter one could end a fake master while a busy runner was relaying a question.

Validation

• CI: 3 consecutive green runs of the final commit (run 39845097592, attempts 1–3). The suite took 31.7 s, 35.2 s, and 29.0 s. Timings that would have exceeded the old budgets:
  • closingAHostWithdrawsItsQuestion: 5.2 / 8.1 / 3.9 s (old budget 5 s per wait)
  • layoutChangesAreCapturedAfterADelay: 10.2 / 9.9 / 6.7 s (old budget 5 s)
  • renderLauncherForReview: 9.0 / 9.9 / 6.6 s
• Local (M-series, 12 cores): the full suite passed 9 times in a row on the final test code, 5 of those with 16 yes processes saturating the CPU. Before the last DiffTests fix, a loaded run caught one more fixed-sleep race, which is now fixed. Earlier, the affected suites passed in repeated isolated loops.
• Reproduction: a second window that focuses a SwiftUI text field makes the original launcher test fail locally with exactly CI's assertions. With FocusIsolatedWindow, it passes.
• code-reviewer subagent: no blocking issues. Its findings are addressed: the VCS cancellation race is fixed, the remaining polling loops are converted, and the property is renamed to sleeper.

Follow-up for the remaining fixed sleeps that haven't been seen failing: #260.

Closes #234. Closes #256.