test(uploads): a queued job at shutdown must never be started; timeout test fails fast

Mutation-testing the worker showed deleting stop()'s cleanup went unnoticed:
Process was incidentally deleting the audio of jobs it should never have
started. The stop test now asserts only the running job was converted (red on
the old code). The timeout test no longer hangs for the 10-minute go test
default when the timeout is removed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/uploads/worker_test.go

@@ -218,8 +218,14 @@ func TestWorkerProcess_ShutdownMidJobLeavesTheRowForTheStartupSweep(t *testing.T
 func TestWorkerProcess_AJobThatOutlivesItsTimeoutIsFailedNotStuck(t *testing.T) {
 	r := newWRig(t, 50*time.Millisecond)
 	r.tr.block = make(chan struct{}) // never released
+	done := make(chan struct{})
 
-	r.w.Process(context.Background(), r.spool(t, "a"))
+	go func() { r.w.Process(context.Background(), r.spool(t, "a")); close(done) }()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Process did not return: a hung endpoint was not bounded by the job timeout")
+	}
 
 	_, f := r.st.snapshot()
 	assert.Equal(t, domain.UploadErrTranscriptionFailed, f["a"], "a hung endpoint must end in failed, not an eternal spinner (ADR-025)")
@@ -270,6 +276,7 @@ func TestWorkerRun_StoppingDeletesQueuedAudioAndRefusesNewJobs(t *testing.T) {
 	cancel()
 	<-stopped
 
+	assert.Len(t, r.conv.srcs, 1, "a job still queued at shutdown must never be started: only the running job was converted")
 	assert.Empty(t, r.leftovers(t), "audio of queued jobs is deleted on stop: the rows are swept to interrupted at next start")
 	assert.ErrorIs(t, r.w.Submit(r.spool(t, "c")), uploads.ErrStopped)
 }