R-1254 (controller half): escrow claim/confirm outwait the agent (60 s); an unknown confirm outcome promises nothing

504 from the agent (it cannot learn which package the hub holds) or a failed call -> api.escrow.confirm_store_unknown
(hu+en); only 502 keeps 'your previous code still works'. Tests TestR1254_* red before the fix. Commit only.

controller/internal/agentapi/escrow.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"time"
 )
 
 // Controller-driven escrow ceremony client methods (v0.127.0, agent ≥ v0.88.0). The claim call
@@ -108,8 +109,15 @@ type EscrowClaim struct {
 //
 // R-1151: the claim asks the agent to keep the new package until the household typed the code back
 // (`defer_upload`). An agent older than 0.160.0 ignores the body and uploads as before.
+// escrowCallTimeout bounds the claim and the confirm (R-1254 H2). The agent may take its whole upload timeout (30 s)
+// plus its question to the hub (15 s) before it answers; the client's own 15 s used to abandon the call while the
+// agent went on — a claim abandoned that way could still store the package, and its code reached nobody. 60 s
+// outlasts both (TestR1254_ClaimAndConfirmOutwaitTheAgentsUpload; the agent side: escrowUploadTimeout,
+// escrowHoldTimeout in felhom-agent internal/localapi/escrow_ceremony.go — if either grows, this must too).
+var escrowCallTimeout = 60 * time.Second
+
 func (c *Client) EscrowCeremonyClaim(ctx context.Context) (EscrowClaim, int, error) {
-	env, status, err := c.postWithStatus(ctx, "/escrow/ceremony/claim", map[string]bool{"defer_upload": true})
+	env, status, err := c.postWithStatusTimeout(ctx, "/escrow/ceremony/claim", map[string]bool{"defer_upload": true}, escrowCallTimeout)
 	if err != nil {
 		return EscrowClaim{}, status, err
 	}
@@ -141,7 +149,7 @@ func (c *Client) EscrowCeremonyClaim(ctx context.Context) (EscrowClaim, int, err
 // match (still waiting), 410 the window ran out, 404 nothing waits (superseded, restarted), 502 the hub failed (still
 // waiting). The words are part of the recovery code — never logged.
 func (c *Client) EscrowCeremonyConfirm(ctx context.Context, words []string) (int, error) {
-	env, status, err := c.postWithStatus(ctx, "/escrow/ceremony/confirm", map[string][]string{"words": words})
+	env, status, err := c.postWithStatusTimeout(ctx, "/escrow/ceremony/confirm", map[string][]string{"words": words}, escrowCallTimeout)
 	if err != nil {
 		return status, err
 	}