fix(controller): stop a failed test from hanging the unit suite (bug-1429); mkstemp for upgrade temp file (bug-1861)

A failing TEST_ASSERT longjmps out and skips the fixture teardown, leaving
the commit engine's sweep thread and persist's fsync_worker asleep on a
static struct. The next test re-inits it underneath them, corrupting the
condvar, and a later teardown blocks in pthread_cond_destroy/join until
the 300s meson timeout. The failure line itself was lost because stdout
was fully buffered.

- controller_test: line-buffer stdout; tearDown() reaps what a failed test
  leaked via new XCE_TESTING registries (persist_test_reap_unstopped, then
  commit_test_reap_unfinalized_engines -- persist_stop before engine fini).
  Clean run reaps 0; an injected failure now fails in 2s instead of hanging.
- persist: flusher_flush_once reports only its own durable advance, so
  fsync_worker no longer re-fires the durable callback for an advance a
  concurrent persist_flush made (flaky "must not re-fire" test). Regression
  test test_flusher_pass_does_not_claim_concurrent_flush_advance.
- tests: jap observer is atomic and waits (bounded) for a continuation that
  may resolve on the flusher thread; pump catch-up tests wait for trailing
  replies instead of a single scan.
- config_repl: upgrade decode temp file via mkstemp instead of a
  pthread_self()-derived /tmp name (same value across processes, opened
  without O_EXCL -- collisions and a symlink target).

Verified: controller_unit_test 1222/1222; 24 parallel runs (6x4), no
hangs or ASAN errors.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/controller/config_repl.c

@@ -1723,11 +1723,13 @@ static int do_upgrade_config_with_bytes(cluster_t *c, endpoint_t *ep,
     /* 2. Write to a temp file and decode via load_cluster_config_from_file().
      *    This reuses the same decode path as the normal config load and avoids
      *    direct in-memory capnp buffer manipulation.                          */
-    char tmp_path[4096];
-    snprintf(tmp_path, sizeof(tmp_path), "/tmp/xce_upgrade_cfg.%lu.tmp",
-             (unsigned long)pthread_self());
+    /* mkstemp, not a pthread_self()-derived name: that is the same value in
+     * every process (so two controllers/test runs on one host clobbered each
+     * other's file) and, opened without O_EXCL in world-writable /tmp, a
+     * symlink target. mkstemp creates it exclusively, mode 0600. */
+    char tmp_path[] = "/tmp/xce_upgrade_cfg.XXXXXX";
 
-    int fd = open(tmp_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
+    int fd = mkstemp(tmp_path);
     if (fd < 0) {
         send_upgrade_error(ep, req, c, -EINVAL, "Failed to create temp decode file");
         return -errno;