R-1254 (controller half): escrow claim/confirm outwait the agent (60 s); an unknown confirm outcome promises nothing

504 from the agent (it cannot learn which package the hub holds) or a failed call -> api.escrow.confirm_store_unknown
(hu+en); only 502 keeps 'your previous code still works'. Tests TestR1254_* red before the fix. Commit only.

controller/internal/web/escrow_handlers.go

@@ -352,6 +352,12 @@ func (s *Server) escrowConfirmAPIHandler(w http.ResponseWriter, r *http.Request)
 			escrowJSON(w, http.StatusGone, map[string]any{"restart": true}, s.msg(r, "api.escrow.confirm_expired"))
 		case http.StatusNotFound:
 			escrowJSON(w, http.StatusGone, map[string]any{"restart": true}, s.msg(r, "api.escrow.confirm_lost"))
+		case http.StatusGatewayTimeout, 0:
+			// R-1254 H2: the agent could not learn which package the hub holds (504), or this call itself failed (0 — it may
+			// have timed out while the agent still stored the package). Either way the new package MAY be on the hub: no
+			// promise about the previous code. Only 502 (the hub holds another package) keeps the store-failed sentence.
+			s.logger.Printf("[WARN] [web] escrow confirm outcome unknown (status %d)", status)
+			escrowJSON(w, http.StatusGatewayTimeout, nil, s.msg(r, "api.escrow.confirm_store_unknown"))
 		default:
 			s.logger.Printf("[WARN] [web] escrow confirm failed (status %d)", status)
 			escrowJSON(w, http.StatusBadGateway, nil, s.msg(r, "api.escrow.confirm_store_failed"))