#1209 Lease heartbeats: rewrite every 25 s instead of 5 s on idle projects

Fewer file rewrites on idle projects. This cuts the steady FSEvents load from AFT's storage folder on macOS.

Measured first: on a live daemon, every connected project rewrote two small lease files every 5 s (artifact-owners/*/owner.json and inspect/*/writer.lease), about 67 file changes per 15 s with about 68 projects connected. Opening 10 to 140 idle FSEvents streams cost fseventsd only about 6 KiB each and no CPU, so the stream count isn't the cause and the streams are unchanged. Merging each root's two streams would lose Git metadata events.

Change

• fs_lock leases and owner manifests refresh every 25 s instead of 5 s, so an idle project makes 2 writes a minute instead of 12. Retry wakes stay at 5 s, so a failed write retries promptly.
• Unchanged: the 75 s window before another host may treat a lease as abandoned, and same-host liveness by PID plus process start time, which never uses heartbeat age.
• The first refresh deadline is set before the lease is published, so a late-starting heartbeat thread refreshes at once.
• The live-owner warning age now allows for the longer cadence.

Tests: 2 writes per idle minute for both lease kinds (I/O ledger: no fsync, no new files); a beat 40 s late keeps the owner live for local and foreign readers; a failed write is retried on the next 5 s wake.

Build server (current main): 505 fs_lock, artifact_owner, root_cache, storage_retention, inspect cache and build_breaker tests, formatting and the Windows check.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Reduces heartbeat file rewrites for idle locks from every 5 seconds to every 25 seconds, cutting steady FSEvents load in AFT's storage folder on macOS.

• Idle projects now write 2 lease files a minute instead of 12; retry wake-ups stay at 5 seconds.
• The first refresh deadline is set before the lease is published, so a late-starting heartbeat thread refreshes immediately.
• The live-owner warning age now accounts for the longer cadence; the 75-second cross-host takeover window and same-host PID liveness are unchanged.
• artifact_owner uses the same refresh cadence and adds tests for delayed and failed refreshes.