test(relay): drill the cache-residency gate against a real severed Redis

The residency gate's two halves were each unit-tested in isolation against
`insert_established_for_test`, but nothing exercised the composition: a
community whose invalidation topic is severed *while a caller is resolving
authorization*. That is the silent-stale-authz hole the whole B1 design
exists to close — an entry admitted in the reconnect gap stays readable for
a full TTL with nothing able to drop it, and reports no error anywhere.

The drill composes the production objects `main.rs` wires (`PubSubManager`,
its own `cache_invalidation_topics()`, a `CacheResidency` at
`AUTHZ_CACHE_TTL`) and walks bootstrap -> open gate -> `CLIENT KILL` sever
-> suppression -> resume, asserting real delivery either side of the sever
rather than establishment bookkeeping. No production code changes, and no
new production seam.

It lives in buzz-relay because it must: `CacheResidency` is here,
`CommunityTopics` is in buzz-pubsub, and the dependency edge only runs
relay -> pubsub. The `clients_with_exact_subs` helper is therefore a
test-private twin of the buzz-pubsub one rather than a new `pub`
cross-crate surface whose only consumer is one test.

Which forces the ci.yml change. The Redis-ignored step selected
`package(buzz-pubsub)` alone, so an `#[ignore]`d test added here would pass
locally and gate nothing; the selector now names `state::redis_tests` too.
Verified under that exact expression via nextest, not a package run: 54/54
pass, and a dead-port control (`REDIS_URL` -> 127.0.0.1:6399) makes the
drill FAIL rather than self-skip.

Two bounds in the drill are load-bearing and were both found by mutation,
not by reading:

* The sever's gate-close wait is 500ms, far below the 1s reconnect backoff.
  `connect_and_serve` also clears establishment on connect, so a generous
  bound is satisfied by that later clear — verified: with a 15s bound the
  test still passes with the reconnect-gap `clear_established()` deleted.
  Only the tight bound can be met by the clear that protects the gap.
* Resume asserts the still-resident community only. The suppressed
  admission re-stamps its own residency; the other six age out at
  `AUTHZ_CACHE_TTL` and are correctly never re-subscribed. Asserting all
  seven claims a property the level-triggered design deliberately lacks and
  turns the test into a race against a 10s TTL.

Mutation results: reconnect-gap clear removed -> fails at the sever assert
in 0.53s; residency gate bypassed -> fails at bootstrap; residency recorded
only when already established (the closed-loop deadlock) -> fails to
converge. Stale-snapshot withdrawal does not bite this drill and should
not: three existing buzz-pubsub tests already cover that invariant.

The two `buzz-relay --lib` failures on this branch
(`telemetry::tests::trace_context_lookup_does_not_enable_callsites`,
`api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo`) are
pre-existing — reproduced identically at a clean 784a5f3a5 with this diff
stashed, 834 passed / 2 failed both ways.

Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
Signed-off-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>

.github/workflows/ci.yml

@@ -694,10 +694,18 @@ jobs:
         # serverless-only rig cannot check. Points at the standalone Redis this
         # job already runs; a cluster-mode service container is deliberately not
         # added here.
+        #
+        # The second selector is the composed cache-residency drill, and it is
+        # named because it CANNOT live in buzz-pubsub: it needs the real
+        # `CacheResidency` (buzz-relay) driving the real subscriber
+        # (buzz-pubsub), and the dependency edge only runs relay → pubsub. A
+        # `package(buzz-pubsub)` selector does not reach buzz-relay, so without
+        # this line the drill would pass locally and gate nothing — the exact
+        # fake-green class the rest of this step exists to remove.
         run: |
           cargo nextest run \
             --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'package(buzz-pubsub)' \
+            -E 'package(buzz-pubsub) or (package(buzz-relay) and test(/state::redis_tests::/))' \
             --run-ignored all
         env:
           REDIS_URL: redis://localhost:6379