fix: harden orchestrator startup and tool dispatch timeouts

[l50]

Summary

Four independent failures observed during a live op against the GOAD lab. Each is addressed in isolation; no behavioral changes outside the failing paths.

Bug 1 — orchestrator double-init of tracing subscriber. ares --redis-url <url> orchestrator panicked with SetGlobalDefaultError. main.rs detected the orchestrator subcommand by checking args().nth(1), but global flags shift the subcommand later in argv, so main initialized telemetry as ares-cli and orchestrator::run reinitialized as ares-orchestrator. ares-core/telemetry/init now uses try_init() and returns a no-op guard on a second call; ares-cli/main scans all argv for the subcommand name.

Bug 2 — NATS tool dispatch timeout too short for nmap recon. async-nats defaults request_timeout to 10s. The dispatcher's outer tokio::time::timeout(1500s, client.request(...)) never got to apply because the NATS client raised `request timed out: deadline has elapsed` first. Bumped client request_timeout to 30 minutes at connection time and added a per-tool floor table so slow recon tools get a minimum deadline that exceeds their worst-case runtime.

Bug 7 — stale JetStream consumer blocks orchestrator restart. The result-demux consumer on ARES_TASKS was ephemeral with no durable name; a SIGKILLed orchestrator left it behind, and the next pod hit `filtered consumer not unique on workqueue stream (10100)` on create_consumer. Switched to a deterministic durable name (ares-orch-result-demux), delete-then-create on startup, and an inactive_threshold of 5 min as a server-side safety net.

Bug 9 — org-restricted model defaults silently 403 every task. task red:multi defaults MODEL=gpt-5.2, which OpenAI restricts to allowlisted orgs. Without access every task tipped over with a non-actionable auth string. ares-llm openai provider now classifies 403 + org-restriction phrasing as LlmError::AuthError, augments the message with pointers to OPENAI_ORG_ID and ARES_LLM_MODEL, and the orchestrator runs a 1-token preflight ping right after provider creation so the failure surfaces once at startup instead of N times per submitted op. ARES_LLM_PREFLIGHT_SKIP=1 opts out.

Test plan

• cargo test --workspace --all-features (6,235 tests pass)
• pre-commit run --all-files passes
• Manual: live op against GOAD lab will exercise all four code paths once images rebuild and roll out

[codecov]

Codecov Report

❌ Patch coverage is 39.13043% with 140 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.77%. Comparing base (db1c4ee) to head (08576d0).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
ares-tools/src/cracker/remote.rs	4.90%	97 Missing ⚠️
ares-core/src/telemetry/init.rs	62.79%	16 Missing ⚠️
ares-cli/src/orchestrator/task_queue.rs	0.00%	15 Missing ⚠️
...s-core/src/persistent_store/queries/credentials.rs	0.00%	3 Missing ⚠️
ares-cli/src/history/search.rs	0.00%	2 Missing ⚠️
ares-cli/src/main.rs	0.00%	2 Missing ⚠️
ares-cli/src/history/cost.rs	0.00%	1 Missing ⚠️
ares-cli/src/history/list.rs	0.00%	1 Missing ⚠️
...c/orchestrator/tool_dispatcher/redis_dispatcher.rs	0.00%	1 Missing ⚠️
ares-core/src/nats.rs	75.00%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #353      +/-   ##
==========================================
- Coverage   80.03%   78.77%   -1.26%     
==========================================
  Files         433      418      -15     
  Lines      125577   118527    -7050     
==========================================
- Hits       100500    93375    -7125     
- Misses      25077    25152      +75     

Files with missing lines	Coverage Δ
ares-cli/src/orchestrator/tool_dispatcher/mod.rs	96.80% <100.00%> (+0.43%)	⬆️
ares-llm/src/provider/openai.rs	68.18% <100.00%> (+6.64%)	⬆️
ares-cli/src/history/cost.rs	0.00% <0.00%> (ø)
ares-cli/src/history/list.rs	0.00% <0.00%> (ø)
...c/orchestrator/tool_dispatcher/redis_dispatcher.rs	40.17% <0.00%> (ø)
ares-core/src/nats.rs	76.20% <75.00%> (+0.12%)	⬆️
ares-tools/src/cracker.rs	88.28% <66.66%> (-0.20%)	⬇️
ares-cli/src/history/search.rs	0.00% <0.00%> (ø)
ares-cli/src/main.rs	0.00% <0.00%> (ø)
...s-core/src/persistent_store/queries/credentials.rs	0.00% <0.00%> (ø)
... and 3 more

... and 17 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[l50]

Moving this to my fork — tracking in l50#27 instead.