test: close the deferred test-hardening items (F7-07, F7-09, F1-08)

[lesnik512]

What

Final tail PR (6 of 6) — test / test-infra only, no runtime behavior change. Closes the three items deferred from #91.

• F7-07 — the loop-mode NOTIFY-wakeup tests used min=max=5.0 with a 2s budget (only ~2.5× margin, so load/jitter could let a poll deliver and the test pass even with NOTIFY broken). Bumped the poll interval to 30.0 (15× margin, still under the 60s lease_ttl so no factory warning) — the poll path provably can't meet the 2s budget, so a broken _notify_event wakeup now fails the test instead of flaking it.
• F7-09 — tightened loose telemetry assertions:
  • OTel middleware: exact counts (== 1, not >= 1 / any()); the OTel acked-histogram test now also asserts messaging.outbox.status == "acked".
  • Prometheus middleware: sum matching samples instead of max(...), so a duplicate-series / double-emit regression pushes the total past 1.0 and fails (the max fold hid it).
• F1-08 — extract _claim_fake_row, shared by FakeOutboxClient.fetch and _sync_dispatch, so the lease + deliveries_count increment (the max_deliveries boundary) runs on one path. Note: routing _sync_dispatch through fetch verbatim (as the finding's headline suggested) would gate on next_attempt_at and break sync-mode's documented "future-dated rows fire immediately" — so I shared only the claim mechanics; eligibility gating stays in fetch.

Verification

• just test → 516 passed, 100% coverage
• just lint clean (ruff + ty)

Pass-3 audit: fully closed

With this, every confirmed finding from the 2026-06-14 pass-3 deep audit is resolved, documented, or consciously dropped across PRs #85–#95. The Tail disposition ledger in planning/audits/2026-06-14-deep-audit-pass3-findings.md is the authoritative record.

🤖 Generated with Claude Code