Fix reachability-gate races flagged by Codex on #1389 (#1394)

P1: TorManager.shutdownCompletely() resets didStart asynchronously
(after Arti has actually stopped, up to ~5s later). A brief
offline->online flap could call startIfNeeded() inside that window;
the guard on didStart dropped it, and nothing reevaluated afterwards,
so Tor stayed down while activationAllowed was true. Track shutdowns
in flight and record a deferred start, honored when the last shutdown
finishes (still gated on allowAutoStart/foreground at that point).

P2: NWPathReachabilityMonitor.ingest() cancelled and rescheduled the
flush a full debounce interval from "now" on every observation, even
duplicates (e.g. interface detail changes while still unsatisfied).
ReachabilityDebounce already preserves the original pending.since, so
schedule the flush for the remaining time to the true deadline instead
of restarting the window.

Tests: debounce deadline preservation (pure) + a monitor-level timing
test that a mid-window duplicate does not postpone the offline commit.

Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

localPackages/Arti/Sources/TorManager.swift

@@ -75,6 +75,11 @@ public final class TorManager: ObservableObject {
     }
 
     private var didStart = false
+    // shutdownCompletely() resets `didStart` asynchronously (after Arti has
+    // actually stopped). A startIfNeeded() arriving in that window must not be
+    // dropped — it is recorded here and honored when the shutdown finishes.
+    private var shutdownsInFlight = 0
+    private var startPendingAfterShutdown = false
     private var bootstrapMonitorStarted = false
     private var pathMonitor: NWPathMonitor?
     private var isAppForeground: Bool = true
@@ -90,6 +95,11 @@ public final class TorManager: ObservableObject {
     public func startIfNeeded() {
         guard allowAutoStart else { return }
         guard isAppForeground else { return }
+        if shutdownsInFlight > 0 {
+            SecureLogger.debug("TorManager: startIfNeeded() deferred - shutdown in flight", category: .session)
+            startPendingAfterShutdown = true
+            return
+        }
         guard !didStart else { return }
         didStart = true
         isDormant = false
@@ -329,6 +339,8 @@ public final class TorManager: ObservableObject {
 
     public func shutdownCompletely() {
         SecureLogger.debug("TorManager: shutdownCompletely() called", category: .session)
+        startPendingAfterShutdown = false
+        shutdownsInFlight += 1
         Task.detached { [weak self] in
             guard let self = self else { return }
             _ = arti_stop()
@@ -352,6 +364,12 @@ public final class TorManager: ObservableObject {
                 self.bootstrapMonitorStarted = false
                 // Note: Don't clear startedAt here - it will be set fresh on next startIfNeeded()
                 // Clearing it here races with startup and defeats the grace period
+                self.shutdownsInFlight -= 1
+                if self.shutdownsInFlight == 0 && self.startPendingAfterShutdown {
+                    self.startPendingAfterShutdown = false
+                    SecureLogger.debug("TorManager: honoring start deferred during shutdown", category: .session)
+                    self.startIfNeeded()
+                }
             }
         }
     }