[oschaaf]

Moves the cross-view hammer case from #67 (and its single-process twin) off wall time.

• The two "Retention 18: hammer" cases ran for a fixed 1.5 s of real time against a 2 s real lease and a 60 ms real ceiling. On a loaded host a descheduled thread could outlast the lease, so a borrow lost its protection and the case reported a mismatch for a reason unrelated to the code under test.
• They now run on the test clock. The lease is one day on that clock, and the readers that hold a borrow tick the clock 1 ms per renew (in place of a 1 ms sleep), so the ceiling still passes inside the run and forced steps are still exercised, but only by progress.
• The run ends on work done (the ring wrapped at least four times, at least 2000 borrows served, 200 held-borrow checks, and at least one ceiling-forced step), not on elapsed time. The 60 s wall limit remains only as a hang guard, and a fired guard now fails the case. The cases also check that a forced step happened.
• LeaseTestClock::advance is now safe from any thread (a relaxed atomic add, so the clock adds no synchronization between threads and ThreadSanitizer still sees the lease protocol's own ordering), which the hammer needs.

"Auto stripe sizing keeps writes flowing" was already moved to the test clock in #90, so the rest of #67 is covered here.

Verification (Linux, GCC 13, Release): ctest -j12 --timeout 300 three times in a row: 921 tests, 100% passed each time. With three full suites running at once on the same 12 cores, plus 15 further runs of the hammer cases: 0 hammer failures. Two other tests failed in that overloaded run (the LRU concurrent get+put case and the seqlock wall-time bound); both are wall-time-bound cases (the LRU one has been added to #91) and are not touched here.

CI is unchanged. The macOS job stays single-process: that workaround is for a hang of a parallel run on its 3-core runner, which this test-clock change does not address.

Fixes #67
Refs #91