test(agent): give the peer reconciler a clock seam and delete the timing sleeps

[gen16k]

TestReconciler_SafetyNetSilencedByRecentDirectEvidence is a coin flip on
Windows. It injects direct evidence, sleeps 35 ms, then requires that less than
FallbackAfter (50 ms) has passed — 15 ms of slack against a platform whose
default timer granularity is ~15.6 ms and whose time.Sleep rounds up to the
next tick. One tick of overshoot inverts the assertion. Linux's ~1 ms timers
hide it, so it only ever fails on the Windows leg, on PRs that never touched
cmd/waired-agent — #355, #367, and twice in a row just now on #389.

Both #357 and #384 asked for a clock seam rather than a wider window, and
CLAUDE.md §Test discipline says the same thing ("put the seam below the
behaviour under test"). Widening only moves the coin toss.

The seam is small

The reconciler reaches for the wall clock in exactly two places — Apply
and Tick. Every disco-driven decision is already stamped from the event's own
At (evaluateSwitchLocked(st, e.At, …)), so one now func() time.Time,
defaulted to time.Now in newReconciler, covers the entire surface.

 func (r *reconciler) Tick(ctx context.Context) {
-	now := time.Now()
+	now := r.now()

Production wiring is unchanged in behaviour; the field is read under the same
mutex that already guards Apply/Tick.

What that buys

All seven time.Sleep calls in reconcile_test.go are gone:

• the five Apply/Tick-timed tests install the fakeClock that
  setup_desired_test.go already defines for the setup executor, and state the
  elapsed time exactly instead of approximating it;
• TestReconciler_NoFlapWithinDwellTime needed no seam at all — dwell is
  measured from lastSwitchAt, which its own event stamped, so it just passes a
  later At.

Of the seven, only the two in the silencing test were ever at risk: the rest
sleep past a threshold and want it crossed, so overshoot was harmless. They
are converted for determinism, not because they were failing — #357 asked for
exactly that sweep of the siblings. Package tests drop from ~0.5 s of real
sleeping to 0.27 s.

The tests did not go green for the wrong reason

#384 set this bar explicitly (citing #368). Each converted test still fails with
its subject behaviour removed:

mutation	test that must fail	result
silencing rule (reconcile.go:841) neutralised	SafetyNetSilencedByRecentDirectEvidence	caught
handshake gate (:847) neutralised	StaysDirectIfHandshakeSucceeds	caught
dwell gate (:512) neutralised	NoFlapWithinDwellTime	caught
safety net forced never to fire (:835)	SafetyNetFiresWhenProbesSilent + ColdStartUsesSafetyNet	both caught

TestNewReconcilerHasAClock pins the production wiring: a constructor path that
forgets the clock would not fail any timing test — those install their own — it
would nil-panic in Apply on a real agent.

Verification

go build ./..., go vet, gofmt, golangci-lint (0 issues),
TestReconciler_* at -count=30. -race not run locally (no cgo toolchain on
this box); CI covers it.

docs-not-needed: test-only seam plus a private struct field; no user-visible surface changes.

Fixes #357
Fixes #384

[gen16k]

Closing as a duplicate of #395, which landed on main (674a03d) while this was
in CI. Same diagnosis, same seam — now func() time.Time on the reconciler,
defaulted to time.Now in newReconciler, with Apply and Tick as the only
wall-clock reads. I did not see it in flight; two sessions reached the same
place independently.

#395 is the better change and it, not this, should stand:

• The attribution here was wrong. test(agent): TestReconciler_SafetyNetSilencedByRecentDirectEvidence is a coin flip on Windows — a 15 ms margin against a ~15.6 ms timer tick #384 and I both blamed Windows' ~15.6 ms
  timer granularity. test(agent): drive the reconciler clock in the safety-net silencing test #395 measured it on a real Windows box — idle, sleep(35ms)
  lands at 35.0–36.2 ms and 300 runs pass; under CPU contention the same interval
  hits p95 54 ms / max 88 ms and the test fails 23/200. It is scheduler delay on a
  busy runner, and the CI evidence agrees (0.09 s wall for a test that sleeps
  60 ms).
• It guards a failure mode I missed. Driving the clock introduces the risk of
  picking an instant that skips the peer at the eligibility gate — leaving the
  test green without ever reaching the rule under test. test(agent): drive the reconciler clock in the safety-net silencing test #395 adds a control leg
  running the identical timeline with the RTT sample omitted and requiring the
  flip to relay, so the two legs differ only by the evidence. My mutation testing
  would not have caught a badly chosen instant that still failed for the right
  reason under mutation.

The only delta left here is converting the five remaining time.Sleep calls in
the file. #395 argues those are safe and is right: they are all lower bounds
("wait PAST FallbackAfter") and sleep never undershoots. That makes converting
them a determinism/runtime nicety (~130 ms), not a fix — not worth churning a
file another session just rewrote. Dropping it.