fix(test): resolve flaky integration tests with polling helper

[mvillmow]

Summary

Fix three flaky integration tests by replacing fixed-duration asyncio.sleep() calls with a deterministic polling helper that waits for messages to arrive via NATS callbacks.

• test_publish_task_event_delivers_message — sleep 0.1s → poll up to 5s
• test_concurrent_webhooks — sleep 0.2s → poll up to 5s + add missing flush
• test_consecutive_publishes_both_succeed — sleep 0.1s → poll up to 5s + add missing flush

Root cause: under full-suite CPU contention, 0.1–0.2s sleeps are insufficient for NATS callbacks to fire. The polling helper checks len(received) every 25ms with a 5s timeout, eliminating the race while remaining bounded. Two tests also lacked explicit nats_client.flush() calls that would ensure subscriptions are ACK'd before publishing begins.

Test plan

• All 541 tests pass (unit + integration)
• Three targeted tests pass in isolation
• Integration tests pass 5× back-to-back under full load (confirms race is gone)
• Code passes ruff lint and format checks
• All commits are GPG-signed

Closes #428

🤖 Generated with Claude Code

[mvillmow]

GO: 3 named flaky tests fixed correctly (poll helper + flush); rest is ruff-forced formatting. Remove stray .claude-followup-428.md artifact.

[mvillmow]

Test fix is correct; flush()+poll helper match root cause. Blocker: committed coverage.xml build artifact (absolute path leak, unrelated to #428) must be removed.

[mvillmow]

NOGO: #428 test fixes are correct, but coverage.xml (851-line generated artifact w/ absolute machine path) is committed and not gitignored. Remove + ignore it.