R-488: backup tests read ONE health-wait clock; package 444 s -> ~2 s

waitForHealthy's 3 s settle / 5 s poll / 90 s timeout become package vars (production values
unchanged, pinned by TestR488_HealthWaitDefaultsAreProduction); TestMain shortens them once.
Measured before: 51 of 599 tests held 442 of 444 s, two not-running fixtures 279 s alone.
newOffboxManager now installs a failing SSH fake: TestOffbox_ConfirmedReset was spawning a
real 'ssh felhom@nas.local' and waiting out its 10 s ConnectTimeout.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_test.go

@@ -40,6 +40,13 @@ func newOffboxManager(t *testing.T) (*Manager, *settings.Settings) {
 	if err := m.WriteOffboxSecrets("PRIVATE-KEY-MATERIAL", "nas.local ssh-ed25519 AAAAhostkey"); err != nil {
 		t.Fatal(err)
 	}
+	// R-488: no test reaches a real ssh. Until 2026-10-05 the default runner was left in place, so a
+	// run that reached the set-aside path (TestOffbox_ConfirmedReset's first-night run) spawned a real
+	// `ssh felhom@nas.local` from DooPlex and waited out its 10 s ConnectTimeout. This fake fails the
+	// way an unreachable host does — immediately — and a test that needs ssh to work installs its own.
+	m.SetOffboxSSH(func(context.Context, string, string, int, string, string, string) ([]byte, error) {
+		return []byte("ssh: test harness: no network"), errors.New("exit status 255")
+	})
 	return m, sett
 }