fix(dwn): port the dwn-clients WebSocket liveness discipline

[LiranCohen]

Fixes #273

Stacked on #271 (fix/feed-driven-refresh), which stacks on #270 — will retarget as the stack merges. Review only the top 3 commits.

What changed

Ports the enbox reference WS client's liveness discipline (dwn-clients json-rpc-socket.ts / web-socket-clients.ts, enbox #1364) to meshd's Go subscription client, so half-dead sockets (system sleep, NAT timeout, link flap) are detected in seconds instead of waiting out TCP or the 5-minute fingerprint settle check:

• Per-connection heartbeat (internal/dwn/liveness.go): JSON-RPC rpc.ping every 30s; no pong within 10s → warn + force-close, and the existing run-loop backoff + cursor-resumed resubscribe takes over. The ping id is the heartbeat generation — only the pong for the active ping clears the deadline, so a late pong from a superseded ping can never defuse a newer deadline. The deadline is armed before the write (like the probe path), so even a write stalled on a dead socket gets force-closed and unblocked.
• On-demand health probes (CheckHealth): connected → out-of-band ping with a 5s deadline, coalesced so concurrent probes share one verdict; miss → close + reconnect. In reconnect backoff → the pending wait is fast-forwarded so the next attempt starts immediately. A probe-verified connection also clears any pending heartbeat deadline (one armed before a system sleep must not kill a connection the probe just proved alive).
• Wake signals (internal/engine/wakeprobe.go): the engine's existing netmon.Monitor gets a change callback — on RebindLikelyRequired || TimeJumped (TimeJumped checked separately because resume-from-sleep can suppress the rebind flag), all active subscription streams (feed or topology+delivery) are probed, debounced at 1s. This is the daemon analog of the browser online/tab-visible wake listeners. Callback is deregistered before watcher stop; late callbacks hit a no-op path.
• TS-parity subtleties preserved (verified against the TS source in review): a heartbeat pong clears the deadline even when it's an error response (a server without rpc.ping degrades to an inert heartbeat, not a reconnect loop); a probe error response resolves unhealthy without force-closing, mirroring probeConnection. Constants (30s/10s/5s) match the reference and are configurable for tests.

Not ported, deliberately: the pooled-WS control plane (enbox #1387) — meshd runs 1–2 sockets per endpoint; there is nothing to multiplex.

Verification

• go build ./... — clean
• go vet ./... — clean
• go test ./... -count=1 -race — all packages pass, no data races; liveness tests additionally stress-run at -count=3/-count=5 -race with zero flakes
• New tests: fake-server contract tests (ping emitted after quiet interval, pong clears deadline, missed pong → close + cursor-resumed resubscribe, ack/ping interleaving, per-generation ping-id uniqueness), unit tests for generation discipline / probe coalescing / shutdown resolution, wake-prober debounce + fan-out, watcher-level CheckHealth across streams.
• Independent adversarial review verified TS parity claims against the actual reference source, the coder/websocket concurrent-write-safety claim against the vendored library, lock ordering, and goroutine lifecycle across reconnect cycles.

🤖 Generated with Claude Code