Keep the doorbell listening between callers, and stop a hung test taking CI with it

The test step ran for twenty minutes and had to be stopped by hand. Eighteen suites
had passed; DodoSSH.Client.App.Tests never reported.

◆ ON UNIX, A FRESH SERVER PER CONNECTION LOSES THE NEXT ONE.

The doorbell's accept loop built a NamedPipeServerStream inside the loop, served one
caller and disposed it. That is fine on Windows and quietly wrong on Linux, where a
named pipe is a Unix domain socket: disposing the server closes the *listening*
socket and unlinks its path, so a second launch that connected while the first was
being served has its connection dropped. Its Connect returned, its write succeeded
into a buffer, and nobody ever read it — the launch was told it had rung the
doorbell and the window never came forward.

Reproduced in a container rather than reasoned about, because the two platforms
disagree and this machine is only one of them. Three rings back to back:

    one instance, Disconnect between callers   ->  3 of 3 answered
    a fresh instance per connection            ->  1 of 3 answered

So there is one server for the life of the doorbell now, Disconnect()ed between
conversations, and the socket is never not listening. Which makes leaveOpen on the
reader load-bearing too: a StreamReader disposes the stream it was given, and that
stream now has to survive into the next iteration.

Two things I had wrong about this, both worth recording. Cancelling
WaitForConnectionAsync *does* unblock a pending accept on Linux — that was my first
theory and the container disproved it, so DisposeAsync awaiting the loop was never
the problem. And the app itself never hung: the lost ring is a launch that is
ignored, not a process that stops.

◆ AND THE REASON IT COST TWENTY MINUTES RATHER THAN TWENTY SECONDS.

    await twice.Task.WaitAsync(TestContext.Current.CancellationToken);

That token carries no timeout. A ring that never arrives is then not a failing test,
it is a job that sits there — which is exactly what happened, and it is the more
expensive of the two mistakes because it turns any future bug of this shape into a
runner somebody has to go and stop. Both awaits are bounded now.

TheDoorbellAnswersMoreThanOnce keeps its shape deliberately: two rings back to back
rather than one and a pause, because the gap between accepts is the whole defect. A
test that waited for the first to be answered would pass against the broken version.

ci.yml had no timeout-minutes anywhere, on any job. Every job has a ceiling now, and
the test step has a tighter one of its own — ten minutes against a suite that takes
two — because a hang there is the likeliest of the lot and a step-level timeout names
the step instead of leaving a reader to work out which of fifteen was still running.
None of them is a performance budget; a build that legitimately grows past one should
have the number raised.

Verified both ways on Linux, in a container, against the committed tree and this one:

    31c836f  SingleInstanceTests  ->  hung in TheDoorbellAnswersMoreThanOnce,
                                      still going when killed at 3 minutes
    this     SingleInstanceTests  ->  7 of 7 in 1.3s
    this     the whole suite      ->  570 tests, 0 failed, 88s

And on Windows, where none of this was ever broken: 570 tests, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/DodoSSH.Client.App.Tests/SingleInstanceTests.cs

@@ -42,6 +42,19 @@ public sealed class SingleInstanceTests : IDisposable
     /// </remarks>
     private static readonly TimeSpan Impatient = TimeSpan.Zero;
 
+    /// <summary>
+    /// How long a doorbell is given to ring before the test says it never will.
+    /// </summary>
+    /// <remarks>
+    /// ◆ <b>A bound at all, which is the lesson rather than the number.</b> These two awaits were written
+    /// against <c>TestContext.Current.CancellationToken</c> alone, which carries no timeout — so the run
+    /// where a ring was genuinely lost did not fail, it <em>hung</em>, and took the whole CI job with it for
+    /// as long as anybody let it. Twenty seconds is a hundred times what a local pipe needs and a fifth of
+    /// what it costs to notice; a bound that is never reached costs nothing and a missing one costs the
+    /// build.
+    /// </remarks>
+    private static readonly TimeSpan LongEnoughForAPipe = TimeSpan.FromSeconds(20);
+
     /// <inheritdoc />
     public void Dispose()
     {
@@ -106,16 +119,22 @@ public sealed class SingleInstanceTests : IDisposable
 
         SingleInstance.Claim(paths, Impatient).ShouldBeNull("the profile is taken");
 
-        // Awaited rather than polled: the callback comes off a thread pool thread, and the test's own
-        // cancellation is what bounds a doorbell that never rings.
-        await asked.Task.WaitAsync(TestContext.Current.CancellationToken);
+        // Awaited rather than polled: the callback comes off a thread pool thread. Bounded explicitly,
+        // because the test's own token is not — see LongEnoughForAPipe.
+        await asked.Task.WaitAsync(LongEnoughForAPipe, TestContext.Current.CancellationToken);
     }
 
     /// <remarks>
-    /// A third and a fourth launch work as well as the second, which is what the accept loop is for: a
-    /// <c>NamedPipeServerStream</c> that has served one client cannot serve another, so a doorbell that
-    /// forgot to go round again would answer exactly one refused launch and then leave every later one to
-    /// exit in silence.
+    /// <para>
+    /// A third and a fourth launch work as well as the second, and this is the test that caught the doorbell
+    /// getting that wrong on Linux and only on Linux. A fresh <c>NamedPipeServerStream</c> per connection
+    /// closes the listening socket between callers there, so the second ring was accepted by nobody while
+    /// the launch that made it was told it had succeeded. See <c>SingleInstance.Doorbell</c>.
+    /// </para>
+    /// <para>
+    /// Two rings back to back rather than one and a pause, because the gap is the whole defect: a test that
+    /// waited for the first to be answered before making the second would pass against the broken version.
+    /// </para>
     /// </remarks>
     [Fact]
     public async Task TheDoorbellAnswersMoreThanOnce()
@@ -139,7 +158,7 @@ public sealed class SingleInstanceTests : IDisposable
         SingleInstance.AskTheRunningOneToComeForward(paths).ShouldBeTrue();
         SingleInstance.AskTheRunningOneToComeForward(paths).ShouldBeTrue();
 
-        await twice.Task.WaitAsync(TestContext.Current.CancellationToken);
+        await twice.Task.WaitAsync(LongEnoughForAPipe, TestContext.Current.CancellationToken);
     }
 
     /// <remarks>