Go SDK 5/8: resilient watch

[bkeroack]

Fifth of eight PRs implementing the Go SDK per SATD_GO_SDK_PLAN.md. Stacked on #515 — merge order: #512 → #513 → #514 → #515 → this.

Adds ResilientWatch: a Watch stream that reconnects, re-registers its watch-set, and re-anchors its cursor without the consumer noticing.

The mirror

The client-side mirror is the existing WatchSet — it already holds exactly the right shape (net sets, keyed so a re-assertion overwrites rather than duplicates, which is the node's own semantics). This PR adds the removals that balance its Add* methods, a rendering back into the control messages that reconstruct it on a fresh stream, and a diff for the reload counts.

Two hazards in that rendering get their own tests:

• Lifecycles and depth alarms are the same wire message (AddTransactions), and the node tells them apart only by whether min_depths is empty. Getting it backwards would silently convert every lifecycle watch into a depth alarm.
• min_values is either empty or exactly parallel to scripthashes — a ragged pair misaligns every floor.

Rendering is sorted rather than left to Go's randomized map order, so a replay is byte-identical run to run and diffable against the Rust mirror in PR 7.

One-shot watches the node auto-evicts when they fire — a depth alarm that reached its depth, a finalized lifecycle — are pruned from the mirror as those events arrive, so a reconnect does not re-register a completed watch and burn quota on a done txid.

The loader

WatchSetLoader closes the two gaps a pure in-memory mirror leaves: after a process restart the mirror is empty, and it goes stale if the integrator's truth changes while the stream is down. With a loader configured the mirror becomes a cache of that truth, rebuilt on every connect before any event is pumped. A loader failure is transient and retried on the next connect (a momentary database outage must not kill an at-least-once consumer); a MaxRetries budget converts a permanently failing loader into a real error rather than a consumer that silently never yields.

Reload applies the truth to a live stream as one atomic SetWatchSet, letting the node reconcile under its own lock — no client-computed Add*/Remove* sequence whose ordering could strand coverage or double-charge a quota mid-swap. SetWatchSet does not carry the raw-tx opt-in, so that is reconciled separately and in both directions.

Divergences from the Rust SDK

Both are simplifications Go allows, not behavior changes:

• The transient-reject retry runs on the pump goroutine, so there is no cancellable caller future that could strand a charged-but-unsent retry. Rust needs an explicit PendingReanchor state machine for exactly this.
• Cancel safety comes from the unbuffered handoff, as in ResilientSubscription.

A documented sharp edge

A reconnect re-anchors the chain stream but does not replay watch matches — the node's cursor replay synthesizes events from the block index and deliberately never runs the watch matcher (that needs full block bodies and undo, which is what RescanBlocks is for). A payment confirming while the stream is down produces no ScriptMatched on reconnect; Rescan over the gap is the remedy.

The Rust SDK behaves the same way but does not say so anywhere. ResilientWatch's doc comment now spells it out, and TestE2EMissedMatchesNeedARescan pins both halves — the match does not arrive on its own, and the rescan recovers it — so the day the node changes, the docs change with it.

Tests

Unit (against a scripted bidi server): replay of every kind and its ordering, the lifecycle/alarm distinction, parallel min_values, determinism, removals not replaying, offline edits landing on the next connection, re-anchoring to the resume cursor, transient reject retried internally vs terminal reject surfaced, CursorAccepted adopted as the resume anchor, one-shot pruning, loader canonicality/transience/budget, all four reload paths, cursor seeding, commit-on-poll, cancel safety, and a race-detector exercise driving Next and registrations concurrently.

E2E: reconnect re-registration through a cut TCP proxy, loader rebuild from a truth that moved while disconnected, atomic reload (including that the replaced watch is genuinely gone, not merely unmentioned), restart-resume plus rescan recovery of the missed matches, and a fired alarm not being re-armed.

All 28 new assertions were perturbed once and observed to fail.