fix(schedule): bound preload startup wait

[smiggleworth]

Summary

• replace the one-second Schedule preload reply deadline with a bounded 120-second startup watchdog
• allow deployments to configure the watchdog through FITZ_SCHEDULE_PRELOAD_TIMEOUT_SECS
• log preload start, persisted-family discovery, per-family debug progress, completion time, and timeout
• preserve fail-closed behavior when the Schedule actor exits or the watchdog expires
• add regressions for both a reply delayed beyond one second and an actor that misses an injected deadline
• update recovery/configuration docs and satisfy the Rust 1.98 Clippy diagnostics from the prior CI run
• cancel superseded backend CI runs using workflow- and PR/branch-scoped concurrency

Why

Cloud recovery and the Midge primary lease can complete successfully while Schedule preload is still queued behind actor work. Fitz previously treated a one-second actor reply delay as a preload failure and exited, causing an ECS restart loop even though the exclusive-writer lease had already been acquired.

An unbounded reply wait would remove that false failure but introduce a worse liveness regression when storage or the actor remains alive but stalls. This change gives S3-backed recovery a realistic default budget while retaining a finite, observable startup failure.

Schedule is the only domain with this exact fatal startup reply wait. Other one-second domain waits remain bounded runtime delivery, cleanup, admin, or observability operations. Queue and Stream perform boot storage preparation directly and do not add this aggregate actor-reply deadline.

Midge still has unbounded internal runtime response waits that Fitz cannot interrupt once entered. That follow-up is tracked in cntryl/midge#254.

Validation

• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings -D clippy::pedantic
• cargo test --locked --workspace
• cargo test --locked --lib domains::schedule::sink::tests (25 passed)
• actionlint .github/workflows/ci-backend.yml
• focused red/green regression: actor blocked past an injected 20ms deadline fails explicitly
• focused slow-success regression: actor blocked longer than one second still completes before the configured watchdog

All local validation is green.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.