feat(consumergate): runtime stop/start of queue controllers + deterministic e2e cancel test

[sbalabanov]

Implements the consumer-gate RFC (#374). Stacked on the RFC branch; review this PR for the implementation only.

What

• platform/extension/consumergate — the extension contract: Gate (read side consulted by the consumer middleware: is this group/partition gated, record a parked delivery, stamp its release), Admin (write surface for tests and tooling: close, open, list parked), Config, the Factory interface, and gomock mocks.
• platform/extension/consumergate/file — the first implementation: gate state as plain files in a shared directory (gates/{group}/all, gates/{group}/p-{urlenc(partition)}; parked records at parked/{group}/{topic}/{urlenc(id)}.json). Presence of a gate file means closed, rm opens it; all writes are temp-file-plus-rename.
• platform/consumer — a WithGate option installs gate middleware in front of every registered controller. Closed gate ⇒ the delivery is parked in place (record written first, visibility extended each refresh tick, retry count untouched, partition order preserved) until the gate opens or the consumer shuts down; shutdown while parked leaves the delivery in-flight for normal redelivery. Gate state is a cached poll per (group, partition) at ~1s; read failures fail open with a log + counter.
• Wiring — one option argument at each consumer construction site (gateway log consumer, orchestrator primary + DLQ, runway), enabled by CONSUMER_GATE_DIR; unset means the middleware is absent. The compose stack bind-mounts one shared host directory (SQ_CONSUMER_GATE_DIR, defaulting to /tmp/sq-consumergate) into every service.

E2e cancellation test rewritten on the gate

TestCancel_RecordsIntent (which could only assert the synchronous "cancelling" intent, with a comment pointing at exactly this missing lever) is replaced by TestCancel_CaughtPreBatch_NeverLands, the RFC's stop → observe → start walk-through:

1. Close the gate for runway-mergeconflictcheck, scoped to the test queue's partition, before landing — exact by construction.
2. Land; runway's delivery of the merge-conflict check is parked.
3. Await the parked record — proof the controller is stopped and holding exactly this request's check, i.e. the request is provably pre-batch.
4. Cancel; await terminal cancelled (request_log shows accepted → cancelling → cancelled; operating store shows RequestStateCancelled).
5. Open the gate; await the release stamp. A sentinel request landed on the same queue shares the check/signal partitions with the stale message, so the sentinel reaching landed proves the stale signal was consumed — at which point the cancelled request is asserted still terminal cancelled, never batched, never landed.

The e2e target gains a no-sandbox tag: the bind-mounted gate dir must be a host path the Docker daemon can see, and Bazel 8's hermetic sandbox /tmp is not.

Testing

• make test — 85/85 unit tests pass, including new middleware tests (park/release, partition scoping, shutdown-while-parked, fail-open, cache expiry) and file-store tests.
• make e2e-test — both suites pass; the service logs show the full sequence: delivery parked by consumer gate → request cancelled (not batched) → parked delivery released by consumer gate → skipping mergeconflict signal for halted request.
• make lint, make check-tidy, make check-gazelle, make check-mocks all green.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}