fix(ci): wake-plane gate suite load-tolerance — QuickJS WASM init no longer holds the sandbox chain; sweep arms observe the gate on a budget that cannot sum to the test timeout

Third release-gate strike on wake-plane.test.ts ("present also blocks the timer
sweep before QuickJS..."), failed twice on the v0.39.0 run. CI evidence: the test
died at exactly 30002ms (its timeout), and run 1 also killed the file's other
sweep tests (one at 66.8s for a 30s timeout — timer enforcement itself starved).

Root cause, reproduced in a --cpus=2 container with instrumented timings: the
one-time QuickJS WASM instantiation (newQuickJSAsyncWASMModuleFromVariant) is
awaited INSIDE the process-wide sandbox serialization chain and is not
cancellable. Under CPU-constrained runners it stretched from ~70ms to 108s in
measurement. Every check in the process queued behind it; sweeps escaped only by
burning their FULL budget (ff627372's abort path fires at budget end, not
sooner). The failing test then ran three sequential sweep arms at the default
15s budget: present(0) + absent(15) + unknown(15) = exactly the 30s test
timeout — zero slack by construction.

Product fix (sandbox-runner.ts): module acquisition moves OUTSIDE
withSandboxLock and races the caller's AbortSignal (acquireSandboxModule).
Instantiation is one-time process infrastructure, not an asyncify-suspended
eval, so it must not wedge the chain for unrelated runs (production sweeps
overlap across projects), and a cancelled sweep now reports cancellation the
moment its signal fires instead of paying the compile first. Signal-less
callers no longer burn their per-check timeout waiting for the compile either —
the check gets its full timeout once the module is ready.

Test fix (wake-plane.test.ts, per house precedent fix-the-observation): the
suite asserts the GATE, not sweep endurance, so every sweep runs with an
explicit 2s budget (worst case 3x2s instead of 30s+) and asserts the durable
outcome — present leaves the compiled check untouched (ran=0, next-due still 0,
status still compiled); absent/unknown attempt the check (ran=1) without
surfacing or damaging it. evaluateSmartNotes gains an optional sweepBudgetMs
thread-through (production default unchanged at 10s) so the fourth test's two
arms are bounded the same way.

Adjudication: wholesale load-tolerant treatment applied to the file — three
strikes on one file is a class. The class is "test wall-time = sum of product
budgets sized to equal the test timeout, while one-time infrastructure latency
is unbounded under load". Both halves are fixed: the product no longer holds
the chain during compile, and every sweep in this file now runs on a budget
that cannot sum to the timeout. The only remaining wall-time dependency (tests
that assert REAL QuickJS execution, e.g. sandbox-runner.test.ts, need the
compile to finish within a test timeout) is unfixable by test restructure and
has stayed green across both v0.39.0 CI runs; under a harsher-than-CI 2-CPU
container those still time out, documented as residual.

Also fixes pre-existing lint breakage from f89f6346 (unused imports + format in
messages-transform) that would have failed the next release run's lint step.

Verification: red-before/green-after under --cpus=2 docker (bun 1.4.0, exact CI
invocation); wake-plane file green 5x consecutive under constraints; full
plugin suite green unconstrained (4062 pass); mutation of the gate caught (2
tests red, restored); typecheck + biome green. A preload-based module prewarm
was attempted and REVERTED: it triggered Bun worker SIGSEGVs under constraints
and --parallel implies --isolate (per-file module registry), which defeats
cross-file prewarming anyway.

Co-Authored-By: Alfonso <alfonso@cortexkit.io>
" && git log --oneline -1 && git rev-parse HEAD && git status --short