fix(payments): clarify VA cancellation wait before RKUD transfers ## Changes VA cancellation reported success while its ten-second bank-processing window still blocked RKUD entry. Keep that window and make the feedback reflect the actual cancellation state. Both dashboard and taxpayer flows show a persistent progress toast during the bank request, a waiting toast for any remaining time, then success and a refresh after the window ends. The server subtracts bank and persistence time from the remaining wait, so a slow API response does not start another ten seconds. Cancellation and inquiry stay disabled while waiting; duplicate clicks and stale responses after navigation are ignored. Cancellation tracking now lives in the stable parent payment panel, so server revalidation can remount the snapshot-keyed dialog without aborting the wait or dismissing its toast. The final refresh updates method availability and resets the dialog to the available payment flow. Real React regressions cover both entry points receiving the updated server snapshot before cancellation completes. An RKUD attempt within the final ten seconds of VA validity explains the remaining seconds and asks the user to retry after expiry. Active QRIS and longer-lived VAs retain their existing blocking behavior. Other regression fixtures cover grouped bills, slow responses, feedback timing, errors, and lifecycle cleanup. CI dependency setup uses eight concurrent downloads and a five-minute fetch timeout. Release verification has a 30-minute job budget for cold dependency installation. Its migration CLI fixture now allows 45 seconds for cold PGlite startup within the existing 60-second per-test limit and reports child-process errors and signals. Reviewed Doctor loader contracts record the finite source targets of the new and updated VM fixtures. Fixes #1879 ## Release impact Patch. Correct feedback in the existing VA cancellation and RKUD workflow, with bounded CI setup and regression-fixture adjustments. ## Migration notes No database migrations or application configuration changes are required. ## Validation - Both real React remount regressions fail against the prior implementation and pass after the repair. - 17 focused cancellation, inquiry, and dialog cases pass. - Both migration registry CLI cases pass; all 10 graph-contract checker cases pass. - All four UI policies pass against the actual PR base. - React Doctor changed-source audit is complete with zero errors, warnings, or skipped checks. The full audit also completes with zero errors, warnings, or skipped checks and complete graph coverage. - Syntax checks and git diff --check pass; semantic PR metadata validates as a patch release. - No application build, dev server, or bank API call was run locally. The complete client-cache and payment-architecture fixture files still contain two unrelated existing fixture failures: the deleted-object review lacks a Field boundary, and the transfer-scope case references the removed getTransferPaymentSummary export. The focused results above select the relevant cancellation, inquiry, and dialog cases.