refactor(cp): post-v1 hardening follow-ups from #1528 self-review #1530

Description

Non-blocking hardening items recorded during the round-3 self-review of #1528 (Agent Control Plane v1). None is a correctness, auth, or data-loss defect on a conforming deployment; they were classified SCOPE EXPANSION under docs/review-contract.md and deferred here rather than blocking the roll-up.

1. Verify a pre-existing managed parent dir. prepare_socket_dir_with_managed_parent (crates/openab-core/src/control_plane/local.rs, NotFound arm): when $HOME/.openab already exists but run/ does not, the intermediate dir is not run through the same is_dir / uid == getuid() / mode & 0o077 == 0 checks the final dir gets. Reuse the Ok(meta) verification on the managed parent before create_dir(run).
2. Duplicate guard on the spawn-ack path. primary.rs on_reply (Spawn ack) inserts into tracked / tracked_order without the contains_key guard on_delegate_result has. A non-conforming CP replaying (delegation_id, admission) would orphan accounted_bytes and leave a permanent duplicate in tracked_order. Reject with CommandError::Internal and warn!.
3. Read the cap under the lock. executor.rs admit() reads effective_max() before lock_inflight(), so a concurrent re-register ack can decide one admission against a stale ceiling (off-by-one at most). Move the read below the lock.
4. Single source of truth for the deadline window. 1..=1800 is repeated as literals in local.rs, src/main.rs (clap range) and the MCP JSON schema in src/cp_tools.rs. Export one pub const from openab_core::control_plane::local and assert the schema against it in a test.
5. Garbled bail! string. crates/openab-cp/src/config.rs max_frame_bytes validation message contains a long literal run of spaces (missing \ continuation); the test only asserts contains("bundled runtime minimum") so it hides the defect. Fix the string and tighten the test.
6. Heartbeat test margin. crates/openab-core/tests/cp_client.rs::heartbeats_keep_the_lease_alive asserts expired(2s).is_empty() after a 3.5 s real sleep with a 1 s heartbeat cadence — ~1 s margin under CI load. Widen the ratio or drive the sweep deterministically like the re-register test does.

Use Case

Keeps the CP runtime client at the verify-never-modify / bounded-state standard the v1 contract set, and removes a flake-prone timing assertion from the default cargo test loop. Refs #1528, #1474, #1475.