Task: Implement Hotfix: nightly CI failures

Fix each confirmed nightly failure in its own commit, and find the origin of the two uninitialised sends that valgrind reports.

• Every item in the story's acceptance has a commit or a recorded finding.

1. Change the shell tests and their templates to expect the bare verb.
2. Remove the const that makes the std::move in the trade summary repository redundant.
3. Suppress the NATS async callback thread error slot.
4. Use time_utils::localtime_safe in the cron tests.
5. Find the origin of the uninitialised send with --track-origins=yes.
6. Make the change hub epoch unique within a process.
7. Give nats_connect_error a key function in the library.
8. Name each HTTP client test as it starts, so the macOS hang names itself.

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

Root causes:

• Shell suites: cli 2.3.0 returns the bare verb from completion. ores.shell uses CliFileSession, so no tab completion is reachable. The tests and their templates now expect the bare verb.
• GCC: a const local made a std::move redundant in the trade summary repository.
• Valgrind MPK: the NATS C library holds one per-thread error slot for its async callback thread. The suppression covers this reachable block.
• Valgrind UMR: the cpp_nats_integration_test template read *party_ctx.party_id() for party-isolated parents. In two tests party_ctx is the plain h.context(), so the optional is empty and the read is undefined behaviour. The row got uninitialised bytes as its party_id. The template now reads the session party only when writes are party-scoped. TLS hid the origin. PGSSLMODE=disable and a field probe located it.
• Windows: the cron tests called localtime_r. They now call localtime_safe.
• macOS change stream: two epochs could match on a coarse clock. make_epoch now increases strictly within a process.
• macOS next-fire: the exception missed its catch clause. nats_connect_error now has a key function in the library, which anchors its type info. This is the likely cause, and only the macOS nightly can confirm it.
• macOS HTTP client timeout: cause not found. The tests now print each name at start, so the next hang names the test.

Neither macOS nor Windows ran locally. The nightly run is the final proof for those platforms.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

All local acceptance is met on linux-clang-release-ninja: the shell suites pass with cli 2.3.0, and the two eventing tests report zero valgrind errors. The Windows and macOS fixes and the macOS test-name diagnostic ship unproven until the nightly run.