fix(issues): a send keeps its claim through every step, not just up to the issue

Creating the issue rebuilt the delivery state from scratch and dropped the
claim with it, so for a new issue the claim covered only the creation — a
draft, a screenshot or a second send could change the report under the uploads
and the body edit that follow, which is exactly what the claim is for. The
state is now built on what was read, and a test walks the send's checkpoints
to see the claim still held at each one.

Found by mutation-checking the round-2 tests: removing the claim's release
left them green, because for a new issue there was nothing left to release.

backend/app/issues/gitea.py

@@ -186,7 +186,11 @@ def deliver(
                 "number",
                 "html_url",
             )
+            # Built ON the state read at the start, not in place of it: the caller's claim on this
+            # send lives there, and replacing it would let a draft or a screenshot change the issue
+            # under the uploads that follow.
             state = {
+                **state,
                 "number": created["number"],
                 "pending": [f.name for f in attachments],
                 "links": {},

backend/tests/test_debug_sessions.py

@@ -815,6 +815,28 @@ def test_an_issue_is_created_with_every_file_and_the_screenshots_shown(
     assert len(gitea_fake.calls) == calls
 
 
+def test_the_claim_is_held_through_every_step_of_a_send(gitea_fake, db, make_user, as_user):
+    """The claim is what keeps a draft, a screenshot or a second send out of the way — so it has to
+    outlast the issue's creation, not just reach it: most of a slow send is the uploads after."""
+    from app.issues import gitea
+
+    user = make_user()
+    client = as_user(user)
+    sid = _start(client)["id"]
+    _upload(client, sid, _PNG)
+    _ready(client, sid)
+    session = db.get(DebugSession, sid)
+    debugsession.claim_send(session)
+    db.commit()
+    held: list[bool] = []
+    gitea.deliver(
+        db,
+        session,
+        checkpoint=lambda: (db.commit(), held.append(debugsession.sending(session)))[0],
+    )
+    assert held and all(held)  # after the issue was created, and after every upload
+
+
 def test_a_public_repository_gets_nothing(gitea_fake, db, client, make_user):
     gitea_fake.private = False
     _signed_in(client, make_user)