Wait on the ripening schedule, not a clock, so an exit lands as one UTXO

[CypherBoxLLC]

Stacked on #181.

One exit should arrive as one UTXO. It does not.

drainExits sweeps every claimable capsule into a single transaction, so the whole exit can land as one UTXO at the destination. The last mainnet exit delivered 2,961 sats as five separate UTXOs.

#181 fixed the obvious half of that by holding the sweep instead of claiming the moment the first capsule ripens. The ceiling it holds against is wall-clock, and that is where it still breaks.

The three capsules still in flight on that exit reported:

05ec3efc  claimableHeight 963101
c51eb209  claimableHeight 963142
4b4e567e  claimableHeight 963145

44 blocks, about 7.3 hours. Against EXIT_CLAIM_BATCH_MAX_WAIT_MS = 6h:

Window opens (first capsule ripe)	963101
Window expires, 6h later	~963137
Capsules claimable at that point	1 of 3
Last capsule ripens	963145, ~80 min after the window closed

So it fires window-expired, sweeps one capsule, and the exit splits into two UTXOs. No ceiling tuned in hours fixes this in general: block intervals are stochastic, and the spread is a property of when each branch happened to confirm, not of how long anyone waited.

Blocks are the truth, time is the estimate

ExitState.AwaitingDelta.inner.claimableHeight is populated the moment a leaf confirms, and it does not move. The full schedule is known long before it matters, so "has everything ripened" is a question about the chain tip, not about elapsed time.

decideExitClaimBatch now holds until the tip reaches the last known claimableHeight. That wait provably terminates: the heights are fixed and the chain only goes forward.

The wall-clock backstop stays for the case it is actually good for, and only that case:

• a straggler with no known ripening height (still Processing, no leaf confirmed yet)
• an unreadable chain tip
• the tip has passed every scheduled height and the stragglers still are not claimable, which means wedged rather than slow

A partial schedule does not count. Knowing two heights of three proves nothing about the third, so that falls back to the clock too.

The decision also returns blocksUntilAllReady, which feeds an honest "2 blocks to go" rather than a seconds countdown that visibly stalls and jumps, per spec 7.2.

Testing

21 unit tests, built on the three measured heights above. Mutation-checked:

Restored behaviour	Tests failing
blind wall-clock ceiling (#181 as-is)	3
min instead of max of the ripening heights	2
wait on a schedule while a straggler is unscheduled	1
hold forever once the tip passes the schedule	1

Full unit suite 37 suites / 272 tests. tsc unchanged at the 405 baseline.

Relationship to #191

Independent, and they compound. #191 keeps capsules out of the exit set that would never have become claimable, so there are fewer stragglers to wait on and no dust exit that could hold the batch to its backstop. This one makes the remaining set arrive together.

[CypherBoxLLC]

Landed in main via #208, which merged the device-tested integration branch as a unit.

This PR did not auto-close because its base was another feature branch rather than main, so GitHub never evaluated it against main. Retargeting is refused with "There are no new commits between base branch 'main' and head branch", which confirms the commits are already reachable from main.

Closing as merged.