test(rekey): add Phase 5 settle window for post-second-rekey convergence

Phase 5's per-pair connectivity check ran immediately after the second
rekey cycle, with no settle for routing reconvergence. Under
GitHub-runner CPU contention, post-rekey parent-switches and
coord-cache flushes can take longer than the per-ping 5s timeout for
a small fraction of pairs (1-3 of 20 typically), even though the
rekey mechanism itself completes cleanly. Phase 6 log analysis stays
all-green on these failed runs; the failure is purely connectivity
timing.

Mirror Phase 3's existing 12-second settle pattern: reuse REKEY_SETTLE
and emit the same banner shape. Two-line change. Cost on the success
path is a fixed 12s per suite run.

CHANGELOG.md

@@ -37,6 +37,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   previously required `gh run rerun --failed`. Cost on the success
   path is unchanged because the wait loop returns as soon as all 20
   pairs converge.
+- Rekey integration test (`testing/static/scripts/rekey-test.sh`):
+  added a post-second-rekey settle window in Phase 5, mirroring
+  Phase 3's existing 12-second pattern. Closes the intermittent
+  GitHub-runner Phase 5 per-pair-ping flake caused by post-rekey
+  routing convergence exceeding the per-ping 5-second timeout under
+  runner CPU contention. Cost on the success path is a fixed 12s per
+  suite run.
 
 ## [0.3.0] - 2026-05-11
 

testing/static/scripts/rekey-test.sh

@@ -368,7 +368,8 @@ echo "Phase 4: Second rekey cycle (waiting ${SECOND_REKEY_WAIT}s)"
 sleep "$SECOND_REKEY_WAIT"
 
 # Verify connectivity after second rekey (back-to-back)
-echo "Phase 5: Post-second-rekey connectivity"
+echo "Phase 5: Post-second-rekey connectivity (settling ${REKEY_SETTLE}s)"
+sleep "$REKEY_SETTLE"
 ping_all
 phase_result "Post-second-rekey (all 20 pairs)"
 echo ""