fix(controller): stop a failed test from hanging the unit suite (bug-1429); mkstemp for upgrade temp file (bug-1861)

A failing TEST_ASSERT longjmps out and skips the fixture teardown, leaving
the commit engine's sweep thread and persist's fsync_worker asleep on a
static struct. The next test re-inits it underneath them, corrupting the
condvar, and a later teardown blocks in pthread_cond_destroy/join until
the 300s meson timeout. The failure line itself was lost because stdout
was fully buffered.

- controller_test: line-buffer stdout; tearDown() reaps what a failed test
  leaked via new XCE_TESTING registries (persist_test_reap_unstopped, then
  commit_test_reap_unfinalized_engines -- persist_stop before engine fini).
  Clean run reaps 0; an injected failure now fails in 2s instead of hanging.
- persist: flusher_flush_once reports only its own durable advance, so
  fsync_worker no longer re-fires the durable callback for an advance a
  concurrent persist_flush made (flaky "must not re-fire" test). Regression
  test test_flusher_pass_does_not_claim_concurrent_flush_advance.
- tests: jap observer is atomic and waits (bounded) for a continuation that
  may resolve on the flusher thread; pump catch-up tests wait for trailing
  replies instead of a single scan.
- config_repl: upgrade decode temp file via mkstemp instead of a
  pthread_self()-derived /tmp name (same value across processes, opened
  without O_EXCL -- collisions and a symlink target).

Verified: controller_unit_test 1222/1222; 24 parallel runs (6x4), no
hangs or ASAN errors.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/controller/testsuite/controller_test.c

@@ -5,6 +5,9 @@
 
 #include <unity/unity.h>
 
+#include "commit.h"
+#include "persist.h"
+
 extern void test_persist_types(void);
 extern void test_persist_wal(void);
 extern void test_persist_schema(void);
@@ -110,6 +113,12 @@ void setUp(void) { return; }
 
 void tearDown(void)
 {
+    /* bug-1429: runs even after a failed TEST_ASSERT -- stop the sweep
+     * thread of any commit engine whose fixture teardown was skipped, so one
+     * failure can't corrupt the next test's reused engine and hang the
+     * suite until its timeout */
+    persist_test_reap_unstopped();
+    commit_test_reap_unfinalized_engines();
     printf("\n-----------------------------------------------------\n");
     return;
 }
@@ -178,6 +187,11 @@ int main(int argc, char* argv[])
 {
     argp_parse(&argp, argc, argv, 0, 0, &arguments);
 
+    /* bug-1429: stdout is fully buffered when meson pipes it, so a FAIL
+     * line was lost whenever the run later hung (SIGTERM) or aborted
+     * (ASAN) -- line-buffer it so the first failure is always visible. */
+    setvbuf(stdout, NULL, _IOLBF, 0);
+
     UNITY_BEGIN();
     TEST(test_persist_types);
     TEST(test_persist_wal);