Breaker: enforce max_open_s across probes and sleeps

[davanstrien]

Follow-up from PR #1 Round-6 review.

Breaker.max_open_s is checked only between probe attempts. A probe retains a fixed 30-second timeout and probe_interval sleeps are not capped to the remaining open duration, so the breaker can substantially overrun its configured maximum.

Focused repro: max_open_s=0.05 with a probe taking 0.2s raised after approximately 0.212s.

Apply the same monotonic-deadline pattern used by the retry ladder:

• compute remaining open time before every probe and sleep;
• wrap the probe in the remaining timeout;
• cap sleep to the remaining duration;
• add a deterministic sub-second regression test.

For the default 600-second setting the relative overrun is small, so this is a follow-up rather than a PR #1 merge blocker.