test: the dedup test holds the first delivery until the repeated publish

[giraffesyo]

Summary

TestPublishDedupAndReplay failed the canary CI run of #37 on Postgres 14 (repeated publish = &{... Duplicate:false}). It is a race in the test; no library code changes.

The test publishes a message with a dedup key, publishes it again and expects the second to be a duplicate. A dedup key is free again once its delivery is finalized, and the subscription has one attempt that fails. On a slow runner the first delivery was claimed, failed and discarded before the second publish was made, so the second was a new delivery, as designed. The handler now holds the first delivery until the repeated publish has been made.

Testing

• Reproduced: with a 2-second sleep before the second publish, the old test fails with the CI message and the fixed test passes.
• go test -race -count=30 -run TestPublishDedupAndReplay . passes against Postgres 17.
• golangci-lint: 0 issues.

Only a test changed, so no hopperbench results.

Checklist

• make check passes — lint and the changed test run locally; the full suite runs in CI here
• No cryptography was added (tests run with GODEBUG=fips140=only)
• New or changed SQL in the claim, finalize, rescue or leader paths has a concurrency or chaos test — no SQL changed
• Behavior changes are reflected in docs/PLAN.md — none