fix(stella-core): read every instant, wait and timeout through the Sleeper port

[macanderson]

What this is

The follow-up #6482 said it was leaving behind. That PR fixed the two ambient reads that were also I/O-adjacent (OS entropy, wall clock) and recorded 19 Instant::now() reads as ratchet debt. This one removes every ambient read of time from stella-core's shipping code — the 19 explicit reads, the 9 hidden ones (.elapsed() is an Instant::now() in disguise), and the 4 tokio::time::timeouts, which are the runtime's timer rather than the port — and drops tokio's time feature from the crate. The ratchet baseline is empty.

The port

retry::Sleeper is now the engine's whole time port: now() -> Instant joins sleep and jitter. One port rather than a second Clock because a double cannot answer them apart — a sleeper that suspends virtually has moved its own now, and a timeout is a sleep racing a call. That is tokio's own shape: a paused runtime puts one virtual clock behind sleep and Instant::now. ports::Clock (now_ms) stays what it was — the millisecond clock hosts hand to things that stamp records (fleet ledger, runtime stamps, the hook bus) — and is untouched.

retry::bounded(sleeper, limit, call) is tokio::time::timeout written against the port: futures_util::future::select over the call and sleeper.sleep(limit), call polled first so a ready call never loses to a ready sleep, Option rather than Result because the limit passing is an answer, not an error.

What moved, in shipping code

• Instant::now() → self.sleeper.now() / sleeper.now(): driver (deadline notice, step timing, settlement, speculation pool), dispatch, completion, rate-limit park allowance, sub-agent deadline and tick, accounted call, retry attempt timing.
• .elapsed() → sleeper.now().duration_since(started) at each of the nine sites; CancelUsageGuard carries &dyn Sleeper because a Drop has no caller to hand it now.
• tokio::time::timeout → retry::bounded: the tool dispatch ceiling, the idle generation bound, the task-deadline bound, the accounted call's idle bound. stella-core's tokio features are ["sync"].
• TurnState::new / TurnState::from_checkpoint / BorrowedTurn::adopt take now: Instant; bounded_generation / deadline_bounded_generation take the sleeper. from_checkpoint is public, so stella-cli's resume path and stella-serve's checkpoint test pass Instant::now() — hosts are where that read belongs.
• The hook bus times observer dispatch off the Clock it already holds (wall milliseconds); the quarantine rule needs three consecutive overruns, so one wall-clock step cannot quarantine anything. Its test advances a hand-stepped clock instead of thread::sleep(100ms).

The guard

check-core-no-io.py's floor gains .elapsed() and any tokio::time use; the tokio feature allowlist loses time; the baseline is empty and --update refuses to add to it, so any Instant::now() now fails. Harness: 27 cases (+3: .elapsed(), a tokio timer, the time feature). AGENTS.md rule 2, the crate README and the ci.yml comment say the count is zero.

Test doubles — the part worth reading

An instant-returning Sleeper double was tolerable while timeouts bypassed the port and is a lie once they go through it: EngineConfig::default() arms a 816 s model timeout and a 15 min tool timeout, and an instant sleep makes both fire the moment a provider future waits on another task. Twelve tests failed that way on the first run. The faithful double sleeps on tokio's clock and reads now from tokio::time::Instant::now().into_std(), and the files that use it run #[tokio::test(start_paused = true)]: virtual time is free while the runtime is idle and correct when it is not. driver/tests.rs's and subagent/tests.rs's shared doubles (now named TokioSleeper) and 17 + 7 test files changed that way; hard_drop_write_back and the streaming accounted-call test got the same double. Files with their own instant NoSleep that passed were left alone.

A side effect worth stating: the stella-core lib suite went from 46 s to 2.5 s, because several tests had been paying real backoff sleeps through tokio::time::timeout that the paused clock now skips.

Witness

• retry::tests::bounded_races_the_ports_own_sleep: with a sleeper whose sleep returns at once, bounded(1h, pending) is None immediately and bounded(1h, ready(5)) is Some(5), and the port recorded exactly one 3 600 000 ms sleep. On tokio::time::timeout this waits the real hour.
• check-core-no-io.py on main fails on 19 Instant::now() reads, 9 .elapsed() calls, 4 tokio::time uses and the time feature; here it passes with an empty baseline.

No test was deleted.

Verified

• cargo check -p stella-core -p stella-engine -p stella-tools -p stella-serve -p stella-cli --all-targets: clean.
• cargo test -p stella-core: 893 lib tests + every integration test pass (2.5 s lib). cargo test -p stella-engine: pass.
• make guards-fast: green; ./scripts/test-core-no-io.sh: 27 passed; shellcheck clean.

Closes nothing by design (closes-nothing): this is the remaining half of the audit the maintainer asked for directly.

[sourcery-ai]

Sorry @macanderson, your pull request is larger than the review limit of 150,000 diff characters