GeezerVison

Review summary. This is a test-only fix for the flaky real Kafka FT recovery read (#7765). The diagnosis is sound: the broker sends the EndTxn reply before it writes the commit markers, so a read_committed snapshot can be stale. Judging each EOF against the live HWM fixes that.

missing / medium: regression test. The description mentions an "early-reader" test that starts committed() while the transaction is still open. It fails without the fix and passes with it, but it isn't in the PR. Without it, nothing guards against this flake coming back (feldera-pr-checks rule 4, flaky tests). Please commit it alongside a_committed_transaction_with_a_delayed_reply_is_not_replayed in real.rs. One possible shape:

// in real.rs: begin reading while EndTxn is still in flight, then release it
proxy.hold_commit(true);
let worker = BatchWorker::new(endpoint);
let reader = std::thread::spawn({ let t = topic.to_owned(); move || committed(&t, 1) });
wait(|| proxy.held_commits() > 0, 30_000).unwrap();
assert_eq!(reader.join().unwrap().len(), 1);
proxy.hold_commit(false);

There are no other gate failures: there are no production code changes, no unsafe blocks and no dependency changes.

Review summary. This change touches only tests. Re-querying the read_uncommitted high watermark at each EOF fixes the stale-snapshot timeout described in #7765, and I agree with the diagnosis.

• Flaky test (medium), gate 4: the new a_read_that_starts_before_the_commit_lands_sees_it races the asynchronous produce. If the reader reaches its first EOF before the record lands, the high watermark is 0 and the read returns nothing. See the inline comment for a fix that waits for delivery first. This is the only change I'd ask for before merge.
• Coverage (medium): with that fix, the new test still only checks that the read finishes. It never checks that the snapshot was taken while the transaction was open. I can't confirm the claim that it fails without the fix, because some of those failures could come from the same race.

fred-review did not finish; see https://github.com/feldera/feldera/actions/runs/41854460216

LGTM. This PR only touches tests. The fix fits the root cause: read_records now re-checks the read_uncommitted high watermark at every EOF instead of trusting a read_committed watermark taken before the commit markers land. The precondition (every transaction decided) is written down, and the panic message now says what went wrong.

• Checked, no problem found (flakiness): the new test orders its steps by events, not sleeps: delivery metric, then an open-transaction assert, then the reader's first Fetch, then the held EndTxn. If the reader panics, BatchWorker::drop cancels shutdown and the proxy drop ends the hold, so a failure can't hang the run.
• Commit history (medium): commit 3 ("Order the early-read regression test by the reader's first Fetch") reworks the test added in commit 2. Please squash it into commit 2 before merge. The subjects of commits 2 and 3 also go over 72 characters.