test(control-plane): de-flake auth-link integration tests

The auth-link integration tests failed intermittently in CI (a different
`test_link_*` test each run, always at the same two assertion sites, and on
`main` too) under slow, heavily-parallel jobs such as the llvm-cov coverage run.

Two independent causes:

1. Wrong-link race. `auth_link()` matched the first link sourced from *either*
   the connector or the protected group, but `wait_auth_link()` then asserts the
   source is the connector. During reconciliation a transient protected-sourced
   link can reach the target status first, tripping the assertion. Select the
   connector-sourced link directly so transient links are skipped and the loop
   keeps polling for the one every caller actually expects.

2. Timeouts too tight under instrumentation. Reconciliation occasionally needs
   longer than 30s/15s when the runner is saturated (llvm-cov, parallel matrix),
   causing `wait_*` timeout panics. Double DEFAULT_TIMEOUT (30->60s) and
   SHORT_TIMEOUT (15->30s); the happy path returns immediately, so passing tests
   are unaffected.

No production code changes; test-only.

Signed-off-by: Luca Muscariello <muscariello@ieee.org>

Author: muscariello

crates/control-plane/tests/integration_test.rs

@@ -56,9 +56,11 @@ const LINK_APPLIED: i32 = 2;
 /// Node status constants.
 const NODE_CONNECTED: i32 = 1;
 
-/// Default timeout for waiting on async conditions.
-const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
-const SHORT_TIMEOUT: Duration = Duration::from_secs(15);
+/// Default timeout for waiting on async conditions. Generous headroom so the
+/// reconciler has time to converge under slow, heavily-parallel CI runs
+/// (e.g. `llvm-cov` instrumentation); the happy path returns immediately.
+const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);
+const SHORT_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Per-group registration secrets (each group has its own secret for isolation).
 const TEST_GROUP_SECRETS: &[(&str, &str)] = &[
@@ -1890,13 +1892,15 @@ struct AuthLinkNodes {
 }
 
 async fn auth_link(client: &mut NbClient) -> Option<LinkEntry> {
-    collect_links(client, "", "").await.into_iter().find(|l| {
-        !l.deleted
-            && matches!(
-                l.source_node_id.split('/').next(),
-                Some(AUTH_GROUP_CONNECTOR) | Some(AUTH_GROUP_PROTECTED)
-            )
-    })
+    // Select the connector-sourced link specifically. During reconciliation a
+    // transient link sourced from the protected node can briefly appear; matching
+    // it here would intermittently trip `wait_auth_link`'s
+    // `source_node_id == AUTH_CONNECTOR_ID` assertion. Every caller expects the
+    // connector link, so wait for exactly that one.
+    collect_links(client, "", "")
+        .await
+        .into_iter()
+        .find(|l| !l.deleted && l.source_node_id == AUTH_CONNECTOR_ID)
 }
 
 async fn wait_auth_link(client: &mut NbClient, timeout: Duration, status: i32, msg: Option<&str>) {