Honor ensure timeout during owner transitions

[jeregrine]

Summary

ensure_started_child/3 currently gives a live storage owner only a separate hard-coded five-second window to appear in Group. That caps callers which intentionally provide a longer :timeout, and the wait only watches the originally stored PID instead of re-evaluating an ownership handoff.

This change:

• replaces the registration subdeadline with the caller's single monotonic deadline;
• keeps the transition loop inside the existing per-key/module singleflight leader;
• re-runs the normal lookup/storage/start state machine with bounded exponential backoff and jitter;
• returns the current Group owner, including a replacement owner;
• retries normal CAS-backed startup after the old owner releases its lock;
• never takes over while storage still reports a valid live lock; and
• retains {:error, {:unreachable, last_owner}} diagnostics when the overall deadline expires.

The default remains effectively bounded at five seconds because the default :timeout is unchanged. Callers that provide a longer timeout can now use that full budget.

Tests

Added deterministic coverage for:

• delayed registration of the stored owner;
• concurrent callers remaining singleflight-coalesced during registration;
• owner A being replaced by registered owner B;
• safely starting a replacement after owner A releases its lock; and
• deadline exhaustion re-reading storage while preserving the live lock and returning the last unreachable PID.

Full suite:

386 passed, 35 excluded

Also ran mix format --check-formatted and git diff --check.

[chrismccord]

Fixed via 690de2a . Thanks!