timeout: prevent lost wakeup in TimerStub::poll

[cuishuang]

Summary

TimerStub::poll() could miss a timer notification if Timer::fire() ran after the initial fired flag check but before the waiter was registered.

Notify::notify_waiters() does not retain a permit for future waiters, so the poll could remain pending indefinitely.

This change:

• registers and enables the Notified waiter before rechecking the fired flag;
• returns immediately when the timer fires during that registration window;
• adds a deterministic regression test covering the lost-wakeup race.

Tested by the following cmd:

• cargo test -p pingora-timeout
• cargo clippy -p pingora-timeout --all-targets -- -D warnings