Fix roster deletion, bond-check timeout, stale contact pulls, and a flaky test

[erikwb]

Follow-up fixes from a review of #175, #176 and #179, plus the cause of the intermittent test failures on push runs.

Deleted group roster comes back (#176). A roster adopted from history keeps its legacy key. When two spellings of a name share that key ("Golf"/"golf"), neither thread lists it as an alias, so deleting both conversations left the roster in settings.json, and the next message revived the thread as reply-ready with the deleted recipients. GroupRoutesStore.discard now also matches a roster by the current key for its recorded name, the rule the old history path used.

Roster store filling up (#176). Rosters whose conversation has aged out cannot be selected for deletion but still count toward MAX_GROUP_ROUTES, where every new save failed. At the limit, saving now evicts the oldest roster whose conversation no longer exists. A roster for a conversation that still exists is never evicted; if all 200 are in use, the save fails as before. "Exists" means present in the conversation list, so a group outside the conversation window can lose its roster at the cap.

Bond-check timeout (#175). The 2 s timeout applied only to GetManagedObjects; dbus-python first blocked on its own Introspect with the default 25 s timeout, so a wedged bluetoothd still stalled the GLib loop for about 27 s per check. _object_manager() now builds its proxy with introspect=False. Every caller only calls GetManagedObjects, which takes no arguments.

Contact pull under an abandoned policy (#175). The pull's worker holds a private copy of the storage policy and key, so it committed the phonebook under the old policy after the live one changed, and the rows were erased only when the completion reached GLib. If the daemon stopped mid-pull, they stayed on disk. The worker's snapshot now follows the live revision and refuses to seal or commit once it changes, so the transaction rolls back and the previous cache is kept. The cleanup in _pulled remains for a change that lands after the commit. A pull discarded this way is marked as owed and downloads again as soon as storage is usable.

Flaky private D-Bus tests. Two tests in tests/test_ancs_client.py left real GLib timers on the default main context. On a slow runner the 15 s ANCS request timeout was still pending when the private D-Bus tests pumped that context; the stale client then made blocking calls on the test bus, each stalling 25 s. Both tests now use fake timers.

Validation:

• Full private-D-Bus suite: 1,480 passed. Ruff, Bandit, and mypy passed.
• Each new regression test fails with its fix removed.
• The flake reproduces on the old tests with a forced 16 s pause before the first D-Bus test (about 2m37 stall, one F, abrupt exit), and the full suite passes with the same pause after the fix.
• New private-D-Bus test: with a never-dispatched owner of org.bluez, a 0.5 s bond check returns in under 5 s.

Not addressed: orphaned rosters still cannot be deleted individually below the cap, and the bond check's service-activation wait when org.bluez has no owner is still not covered by the timeout.