brokersemantics: make two fixtures able to fail

Both findings are the failure mode doc.go warns about, in the suite that warns about it: a fixture that measures the semantic away and then agrees with the code for the same reason a fake would.

The heartbeat test called stop() itself, so it proved only that the broker reclaims a delivery once extensions cease — which nothing in the codebase disputes. Deleting keepInProgressMaxTicks outright left it green, so the cap, the whole reason KeepInProgress is safe on a wedged handler, was ungated here and in the unit test (which also stops the heartbeat).

Nothing calls stop now. The handler starts the heartbeat and returns — returning rather than sleeping because nats.go dispatches consume callbacks serially, so a sleeping handler would block the very redelivery under test, and the extension does not depend on the handler still running. The only thing that can release the delivery is the cap firing on its own. The test asserts the extension holds at 3xAckWait and that the reclaim lands near 6xAckWait — 15 ticks at AckWait/3 is 5xAckWait, plus one AckWait for the last extension to expire. The constant is unexported, so the test states the arithmetic rather than importing it.

The permission test invoked only Ack, while the contract just written onto backoff.NakOrTerm promises the same silence for Nak and Term — the two dispositions that policy actually issues. It is now table-driven over Ack, Nak, NakWithDelay, Term and InProgress, each on its own durable and its own message so one silent failure cannot mask another, plus DoubleAck as the surface that does report the rejection.

Violations are attributed by matching the durable named in the rejected $JS.ACK subject rather than by counting, because the subtests run in parallel on one connection and a count would let a sibling's violation satisfy this one's assertion — the same false-green shape a third time.

Both fixtures were mutation-checked: raising keepInProgressMaxTicks turns the heartbeat test red (no redelivery ever arrives), and granting $JS.ACK.> turns every disposition subtest red (the floor advances, nothing stays pending, no violation is reported).