fix(test): prevent watcher_integration leaking threads/tempdirs on panic

Root-caused the 'all-languages' CI job's flaky/multi-hour hangs: each of
the 3 tests in watcher_integration.rs spawns a background watcher thread,
then does `ready_rx.recv_timeout(10s).expect(...)` before its later
`ct.cancel(); handle.join(); remove_dir_all(...)` cleanup. Under the heavy
parallel CPU/IO load the all-languages job creates (12 opt-in language
grammars + scip-overlay + lsp-overlay compiled/tested together), the
watcher's arm+initial-reconciliation step can miss that 10s window; the
resulting panic unwinds past the cleanup lines entirely, leaking a live
watcher thread and its temp project dir for the rest of the process's
life. Reproduced locally under this same load (watcher_hot_reloads_
coverage_file_change failed with exactly this timeout).

Adds a WatchGuard (Drop-based RAII) so cancel/join/cleanup always run,
panic or not, and widens the ready-wait from 10s to 30s to match the
other bounded waits already used in this file. This does not change
crates/calm-server/src/watch_supervisor.rs's actual arm+reconcile
behavior -- that's a separate, bigger design question (signal armed
before vs. after reconciliation) intentionally left for a follow-up.

Verified: cargo test -p calm-server --test watcher_integration (3/3
pass), cargo clippy -p calm-server --all-targets -- -D warnings clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-server/tests/watcher_integration.rs

@@ -9,6 +9,32 @@ use std::time::{Duration, Instant};
 
 use tokio_util::sync::CancellationToken;
 
+/// Ensures the watcher thread is always cancelled/joined and the temp
+/// project dir removed, even if an assertion earlier in the test body
+/// panics. A bare `ct.cancel(); handle.join(); remove_dir_all(...)`
+/// sequence placed at the end of a test never runs on panic (e.g. the
+/// `ready_rx.recv_timeout(...).expect(...)` below, which is exactly what
+/// timed out under the CPU contention of the `all-languages` CI job on
+/// 2026-08-01) -- that leaks a live background watcher thread plus its temp
+/// dir for the rest of the process's life, found while investigating a
+/// flaky/hanging CI run. `Drop` runs during unwind too, so wrapping the
+/// handle/dir in this guard makes cleanup unconditional.
+struct WatchGuard {
+    ct: CancellationToken,
+    handle: Option<std::thread::JoinHandle<()>>,
+    dir: std::path::PathBuf,
+}
+
+impl Drop for WatchGuard {
+    fn drop(&mut self) {
+        self.ct.cancel();
+        if let Some(h) = self.handle.take() {
+            let _ = h.join();
+        }
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
 fn symbol_count(db: &Path) -> i64 {
     let conn = rusqlite::Connection::open(db).unwrap();
     conn.query_row("SELECT COUNT(*) FROM symbols", [], |r| r.get(0))
@@ -76,12 +102,18 @@ fn watcher_reindexes_add_and_delete() {
         })
     };
 
+    let _guard = WatchGuard {
+        ct: ct.clone(),
+        handle: Some(handle),
+        dir: dir.clone(),
+    };
+
     // Wait for the watcher to actually arm its OS-level watch before mutating
     // the tree — a fixed sleep here raced real thread-scheduling delay under
     // load (see `run_watch_loop`'s `ready` doc comment).
     ready_rx
-        .recv_timeout(Duration::from_secs(10))
-        .expect("watcher should signal ready within 10s");
+        .recv_timeout(Duration::from_secs(30))
+        .expect("watcher should signal ready within 30s");
 
     // Add a file → watcher should incrementally index it.
     std::fs::write(dir.join("b.py"), "def b():\n    pass\n").unwrap();
@@ -91,10 +123,6 @@ fn watcher_reindexes_add_and_delete() {
     std::fs::remove_file(dir.join("b.py")).unwrap();
     let removed = wait_for_symbols(&db_path, 1, Duration::from_secs(30));
 
-    ct.cancel();
-    let _ = handle.join();
-    let _ = std::fs::remove_dir_all(&dir);
-
     assert!(added, "watcher should have indexed the added file");
     assert!(removed, "watcher should have dropped the deleted file");
 }
@@ -157,9 +185,15 @@ fn concurrent_edit_write_and_watcher_reindex_does_not_lock_or_go_stale() {
             )
         })
     };
+
+    let _guard = WatchGuard {
+        ct: ct.clone(),
+        handle: Some(handle),
+        dir: dir.clone(),
+    };
     ready_rx
-        .recv_timeout(Duration::from_secs(10))
-        .expect("watcher should signal ready within 10s");
+        .recv_timeout(Duration::from_secs(30))
+        .expect("watcher should signal ready within 30s");
 
     // Simulate edit_lines_impl's own write+reindex sequence, firing right
     // after a file write the watcher is independently about to react to —
@@ -186,10 +220,6 @@ fn concurrent_edit_write_and_watcher_reindex_does_not_lock_or_go_stale() {
     // not leave the DB stale relative to disk.
     let converged = wait_for_symbols(&db_path, 2, Duration::from_secs(15));
 
-    ct.cancel();
-    let _ = handle.join();
-    let _ = std::fs::remove_dir_all(&dir);
-
     assert!(
         converged,
         "DB must reflect the latest file content once both writers settle"
@@ -274,9 +304,15 @@ fn watcher_hot_reloads_coverage_file_change() {
         })
     };
 
+    let _guard = WatchGuard {
+        ct: ct.clone(),
+        handle: Some(handle),
+        dir: dir.clone(),
+    };
+
     ready_rx
-        .recv_timeout(Duration::from_secs(10))
-        .expect("watcher should signal ready within 10s");
+        .recv_timeout(Duration::from_secs(30))
+        .expect("watcher should signal ready within 30s");
 
     // Write a coverage report *after* the watcher is running — this is the
     // "regenerated mid-session" case the fix targets.
@@ -288,10 +324,6 @@ fn watcher_hot_reloads_coverage_file_change() {
 
     let reloaded = wait_for_coverage_source(&coverage, "lcov", Duration::from_secs(30));
 
-    ct.cancel();
-    let _ = handle.join();
-    let _ = std::fs::remove_dir_all(&dir);
-
     assert!(
         reloaded,
         "watcher should have hot-reloaded the new lcov.info without a restart"