fix(callbacks): stabilize retry-wait recovery identity race proof

[dennisonbertram]

Problem

Hosted race CI on #1123 failed TestCallbackManagerRecoveryHonorsRetryWaitAndReusesIdentity: retry dispatched before next_attempt_at (started run_callback_retry-recover). This is outside #1123 native UI diff and is a new callback baseline failure after #1107 merge.

Acceptance criteria

• Determine whether recovery can actually dispatch before durable next_attempt_at, or whether the test uses a load-sensitive timing boundary.
• Preserve durable retry scheduling, run identity reuse, token fencing, no-overlap, recovery authority, and API/task visibility.
• Add deterministic normal/race proof for no admission before retry deadline and correct identity after due time.
• Sol medium diagnosis, issue-linked repair, cheap re-review, full regression and hosted checks before downstream promotion.

Scope

Callback retry-wait recovery implementation/test/docs only. Blocks #1123/#1118 because baseline is red.

[dennisonbertram]

Implementation update: exact base is merged #1107 46e5c0bc453b18e94a0b795aa1ef3b9a21915d53. Sol diagnosis was a fixture timing boundary, not confirmed early production dispatch. Strict red: focused test initially failed to compile with undefined: newCallbackFixtureClock. The test-only repair uses a mutex-protected fake clock with a one-hour durable retry deadline; manual pre-deadline fire proves unchanged retry_wait/run ID/attempt/token/lease and zero starter calls, while post-deadline fire proves attempt-two start with the same reserved run ID and cleared owner fields. No production source changed. Final evidence: focused normal/race x100 0.419s/2.549s; complete internal/harness/tools normal/race 13.200s/14.719s; isolated ./scripts/test-regression.sh PASS normal/race, coverage 85.5%, zero uncovered functions (2m26s). Preparing one PR that closes #1124 for independent review.