test(blackbox): compute drift end states deterministically instead of tolerating a sync window

[JeroenSoeters]

Why

TestProperty_FullChaos fails roughly half of PR runs and blocks merges (#653, #654, #655 are all currently red on it). Every recorded violation lands on a resource the suite itself mutated out-of-band, and both recurring signatures (phantom resource, inventory=... but model expects ...) are one harness defect seen through the delete and modify paths: the suite recorded out-of-band drift in a ManagedDriftedResources exemption map that the invariants consulted to skip slots, and that record was retired before the divergence was actually reconciled, so assertions ran with the exemption gone. Keyed by native id, a second drift op on one resource also aliased onto the first op's snapshot.

What

The exemption never needed to exist. Background synchronization, discovery, and stack expiry are disabled in the harness config, so every sync is harness-triggered and observable, and the suite can always compute a deterministic end state from generated inputs and API responses. This change deletes the drift-tolerance mechanism rather than repairing it:

• Absorb managed drift synchronously at the drift op. OpCloudModify/OpCloudDelete on a managed resource now pick a target untouched by in-flight commands (a command on a stack can create, update, or reconcile-delete any slot on it), shape the drifted properties to the slot's schema (keys outside it split into ReadOnlyProperties and would diverge inventory from cloud), force a sync, and wait for the inventory row to converge. The model records the absorbed end state directly: row gone on delete, cloud properties on modify.
• Same for discovered unmanaged resources, which had the identical latent window.
• Delete the mechanism wholesale: ManagedDriftedResources, PendingSync, HasPendingManagedDriftAffectingSlot, ApplySyncToManagedDrift, ApplySyncCommand, reconcileManagedDrift*, ClearManagedDriftForResource, CheckManagedDriftVsInventory, and the invariant skips in the phantom check and model-vs-inventory check. No invariant is loosened; two skips are removed.
• Model applies its own predicted unmanaged sync transition (ApplySyncToUnmanaged) at every observed sync instead of reading the sync command's resource updates back into the model.
• Make drift-target selection actually deterministic: candidates were enumerated by Go map iteration, so the generated sequence number picked a random resource; they are now enumerated in stable slot order.
• Crash-restart hygiene: once a managed modify is absorbed, the inventory row is the restart re-injection source, so the cloud-state mirror entry is dropped; a lingering entry would overwrite later plugin writes with stale properties after a crash.

Making the syncs strict surfaced four latent harness defects that the old tolerant logging had been hiding; all are fixed here:

1. The awaited-sync baseline race. WaitForNextSyncCommand captured its latest-sync baseline after ForceSync had already fired, so the just-created command could be taken as pre-existing and the wait never matched. This is why TriggerSyncAndWait: no sync command observed kept appearing even when the sync ran. The baseline is now captured before triggering.
2. No-change syncs are unobservable by design. The persister deletes a completed sync command whose reads absorbed nothing (shouldDeleteSyncCommand), so waiting long for one is pure burn: the sync waits are now a short appearance window plus a completion window, and a command that appears and then vanishes counts as an observed no-change sync. This is also what restores the suite's runtime: Sequential iterations are back to ~6s from the 15s-per-trigger burns (green-main baseline ~3s), and FullChaos runs at ~12s/iteration against a 7.2s baseline.
3. Discovery never ingests in this suite. The formas never mark the target Discoverable, so ForceDiscover always ends at "no discoverable targets" and the unmanaged-discovery expectations were dead weight: the old trigger applied the ingestion transition whenever any sync command happened to be observed in its 10-second window, setting expectations for rows that were never ingested. The trigger is now fire-and-forget with no model transition, and surprise ingestion still fails loudly as an unexpected unmanaged inventory row.
4. A canceled changeset's resources stay sync-excluded past the cancel. The synchronizer kept logging Excluding resource from sync (in-progress operation) for a canceled command's resource 25+ seconds after the command was terminal, so drift injected on it could never absorb. The window is unobservable from outside the agent, so stacks touched by a canceled command leave the drift-target pool for the rest of the iteration. The agent-side behavior is filed separately (internal: PLA-712) since in production it means drift on those resources silently stops being absorbed.

Net -130 lines.

Verification

• New model-level tests (written first, watched fail): absorbed end states for modify/delete, in-flight-command / cross-stack / canceled-stack eligibility exclusions, deterministic candidate ordering.
• TestProperty_FullChaos local: green at 25 checks (23m, pre-perf-fix), 30 checks (23m), 10 checks (2m), and 25 checks (5m) after the performance fixes; each earlier failing run root-caused one of the four defects above rather than being re-rolled.
• The four other property suites green locally at 15 checks each; Sequential re-measured at ~6s/iteration after the fixes.
• go vet clean under property and integration tags; golangci-lint below main's baseline with no new issues.

Fixes the flake tracked in PLA-448 (internal).