fix(operator): wait for inclusion on rollup-message injection - #39

Both inject_direct_message call sites used `-w none` (fire-and-forget): the op
was injected into the mempool but the call returned before it was baked, so it
released advance_lock while the on-chain counter was still stale. octez-client
computes the next op's counter from on-chain state, so the following injection
from the operator key reused the same counter and L1 rejected it:

  cannot be added because the mempool already contains a conflicting operation

That marked the shield `failed` (not retried); the next shield self-recovered.

Switch both sites to `-w 1` so each op is baked before advance_lock releases —
the counter always advances before the next injection is built, so the conflict
can't occur. Costs ~1 block of latency per injection held under the lock.

Test: attested_dal_submission_sends_pointer_message now asserts the pointer
inject waits (`-w 1`, not `none`).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Follow-up to waiting on inclusion (-w 1). Two hardening changes:

Timeout: `-w 1` blocks until the op is baked, under advance_lock. Without a
bound, one op that never confirms would hang the injection forever and wedge
the whole operator (reconciler + every submit stall on the lock). Add a 180s
ceiling in run_command_collect_output: capture stdout/stderr to temp files
(pipes could deadlock on a long wait, and files let us keep partial output),
poll try_wait to a deadline, kill on expiry, and return a timeout error that
still carries whatever octez-client printed.

Idempotency: octez-client prints the op hash the moment it injects, before it
waits. So an injection can reach the node and *then* error (a confirmation
timeout or RPC blip). Both inject_direct_message call sites now check for an op
hash in the error: if present, the op is on the node, so record it as
SubmittedToL1 instead of Failed / instead of propagating the error. This stops
the reconciler from injecting a duplicate pointer op on the next tick. Inclusion
is not verified here — a genuinely dropped op is still caught by the caller's
settlement timeout.

Tests: pointer_inject_error_with_op_hash_is_recorded_not_retried (idempotency),
run_command_times_out_and_keeps_partial_output (timeout + partial-output). 33/33.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>