Jepsen-style checkers: treating timeouts as 'indeterminate' silently passes deadlocks

When a history checker models a client give-up (-ETIMEDOUT) or never-returned call as 'indeterminate, may land any time', a server that wedges one file or stops answering produces only indeterminate ops and the run passes. Fix: add a liveness pass. An error that can't legitimately happen in the workload is a violation; a give-up is only allowed if its [invoke, return] interval overlaps an injected outage at least as long as the client's retry deadline on that client's connection (pause = all clients, proxy hold/drop = one). Have the driver log which client indices sit behind the fault proxy so the checker can attribute per-connection faults. Validate with a negative control: a server patched to block forever on writes to one file after N seconds should fail the new check and pass the old one.