fix(wait-for-hydra): add periodic re-checks during SSE stream

CDN proxies like Cloudflare may buffer SSE events, preventing real-time
delivery of status updates to the client. This caused the script to
hang indefinitely on the SSE stream even after the build completed.

Three fixes:

1. Periodic one-shot re-check: every 120s, poll the bridge's cached
   /status endpoint directly. This catches status changes even when
   SSE events are buffered or lost.

2. Reserve time for fallback: set curl --max-time to TIMEOUT - 120s
   so there's always 2 minutes left for one-shot re-check + polling.

3. Final one-shot re-check after SSE stream ends, before entering
   the polling fallback loop.

Author: angerman

wait-for-hydra/support/wait.sh

@@ -114,9 +114,45 @@ sse_wait() {
     # when the SSE stream is idle (Cloudflare buffering, no new events).
     # Without this, read blocks indefinitely and the script's TIMEOUT is
     # never enforced. In bash, read -t returns >128 on timeout, 1 on EOF.
-    echo "SSE: Connecting to ${base_url}/events (filtering for '$HYDRA_JOB')"
+    # Cap the SSE stream time to leave room for one-shot re-check and
+    # polling fallback if the stream ends without delivering our event.
+    # Reserve 2 minutes for fallback; minimum SSE time is 60 seconds.
+    local sse_max_time
+    if [ "$TIMEOUT" -gt 0 ]; then
+        sse_max_time=$((TIMEOUT - SECONDS - 120))
+        [ "$sse_max_time" -lt 60 ] && sse_max_time=60
+    else
+        sse_max_time=86400  # no timeout: cap at 24h (matches cache TTL)
+    fi
+
+    # Track when we last did a one-shot re-check so we can poll the
+    # cached endpoint periodically. CDN proxies (e.g. Cloudflare) may
+    # buffer SSE events, so we re-check every 120s as a safety net.
+    local last_recheck="$SECONDS"
+
+    echo "SSE: Connecting to ${base_url}/events (max ${sse_max_time}s, filtering for '$HYDRA_JOB')"
     while true; do
         check_timeout
+
+        # Periodic one-shot re-check: catch status changes that the SSE
+        # stream failed to deliver (CDN buffering, lost events, etc.).
+        if [ $((SECONDS - last_recheck)) -ge 120 ]; then
+            last_recheck="$SECONDS"
+            local poll_state
+            poll_state=$(sse_get_current_status "$base_url") || true
+            if [ -n "$poll_state" ]; then
+                local poll_result
+                poll_result=$(classify_status "$poll_state")
+                if [ "$poll_result" = "success" ]; then
+                    echo "$HYDRA_JOB succeeded (from periodic re-check at ${SECONDS}s)"
+                    exit 0
+                elif [ "$poll_result" = "failure" ]; then
+                    echo "$HYDRA_JOB failed (from periodic re-check at ${SECONDS}s)"
+                    exit 1
+                fi
+            fi
+        fi
+
         local read_rc=0
         IFS= read -r -t 60 line || read_rc=$?
         if [ "$read_rc" -gt 128 ]; then
@@ -146,7 +182,7 @@ sse_wait() {
                 fi
                 ;;
         esac
-    done < <(curl -Nsf --max-time "$((TIMEOUT > 0 ? TIMEOUT - SECONDS : 0))" \
+    done < <(curl -Nsf --max-time "$sse_max_time" \
         "${base_url}/events" 2>/dev/null)
 
     # SSE stream ended without a terminal event for HYDRA_JOB. This can