fix: resolve 16 confirmed bugs from the 2026-06-12 code audit (B1–B16)

[lesnik512]

Summary

Fixes all 16 confirmed bugs from the 2026-06-12 code audit (planning/active/2026-06-12-code-audit-findings.md). Each fix ships a regression test that fails on the pre-fix code. Suspected findings, test-holes, and improvements (P1–P35) are intentionally out of scope for this PR.

Data integrity / delivery

• B5/B6/B7 — the reject-fallback trap. AckPolicy.MANUAL + a handler exception, raise NackMessage(delay=…) kwargs, and retry-strategy errors no longer silently DELETE a row. assert_state_set now nacks (honoring the retry strategy) when an exception is present; ack/nack/reject accept-and-ignore **options; a raising strategy degrades to retry_terminal; ExponentialRetry clamps the exponent to avoid OverflowError.
• B8 — publish_batch no longer drops a leading/sole None body (OutboxPublishCommand overrides batch_bodies to keep every positional body).
• B10 — the DLQ CTE and validate_schema are schema-aware (format_table / MetaData(schema=...)); MetaData(schema="app") deployments no longer hit UndefinedTable on every terminal failure.

Liveness / health

• B1/B2/B3/B4 — fetch loop halts on drain (no connection-churn storm / test-broker livelock), start() resets _stopping, backoff resets after sustained uptime, and the LISTEN connection is closed when add_listener fails or is cancelled.
• B11/B12 — ping() walks the subscribers property (so router-registered subscribers are checked) and honors its timeout via anyio.move_on_after.

Metrics / packaging

• B9 — the Prometheus in-process gauge no longer goes negative (the .dec() is gated on duration_seconds, absent on the max_deliveries terminal).
• B13 — the friendly missing-extra ImportErrors are now reachable (probe-guarded container import in metrics/prometheus.py; import-time friendly errors on the native middleware).

Test broker

• B14/B15/B16 — loop-mode spawns each loop once (not twice), loop tasks are cancelled+cleared on context exit, and the fake fetch_unprocessed accepts limit=.

Test Plan

• Full dockerized suite (Postgres 17): 423 passed (401 baseline + 22 new), 100% coverage gate met
• ruff format + ruff check + ty check clean
• Each bug's regression test verified red on the pre-fix code (where mechanically feasible)

🤖 Generated with Claude Code