Flaky tests: readiness TempDir .git cleanup race; gitlab TestPublishDraftRecoversALostAnswer TLS race #418

Two tests flaked on Nov 8, each in a run whose change didn't touch their package. Both passed on rerun.

1. TestMarkdownRuleKeepsTheManifestRuleForEveryOtherPath (lab/internal/readiness)

Seen in the Lab candidate run of mol-413 (local macOS, under load):

--- FAIL: TestMarkdownRuleKeepsTheManifestRuleForEveryOtherPath (1.41s)
testing.go:1617: TempDir RemoveAll cleanup: unlinkat <check-tmp>/gotmp/TestMarkdownRuleKeeps…/001/.git: directory not empty

Likely cause: a git process the test started (or one git spawns in the background, such as auto-gc or maintenance) is still writing under .git when t.TempDir cleanup runs. Fix: make sure every git command the fixture runs has exited before cleanup, and disable background work in fixture repos (gc.auto=0, maintenance.auto=false, and core.fsmonitor=false).

2. TestPublishDraftRecoversALostAnswer (lab/plugins/gitlab)

Seen on CI macos-latest for PR #417, run 42463805644; ubuntu passed:

http: TLS handshake error from 127.0.0.1:…: use of closed network connection
--- FAIL: TestPublishDraftRecoversALostAnswer (0.14s)
tools_test.go:287: forge_publish_draft: network: GitLab could not be reached

Likely cause: the test's TLS server, or the "lost answer" connection drop, races the client's retry, so the retry reaches a closed connection and is classified as a network failure. Fix: make the drop deterministic (for example, close only after the response is written, and use a readiness channel rather than timing), and have the test wait for the server to accept before the retry.

Done when

• Each test is deterministic under -count=50 -race locally, or uses a seam instead of timing.
• No behaviour change outside the tests and their fixtures.