fix(api): subscribe to gsoc before websocket upgrade

[acud]

Checklist

• I have read the coding guide.
• My change requires a documentation update, and I have done it.
• I have added tests to cover my changes.
• I have filled out the description and linked the related issues.

Description

The master Coverage Report job has been failing intermittently since #5614 with TestGsocWebsocketSingleHandler / TestGsocWebsocketSocFields hitting a 30s i/o timeout (e.g. run 36754977013).

gsocWsHandler called upgrader.Upgrade before s.gsoc.Subscribe. Upgrade flushes the 101 response, so the client's Dial can return and a GSOC update can be delivered before the subscription is registered — the update is then silently dropped. Coverage instrumentation slows the handler enough to widen this window, which is why only the master-only coverage job was red. Real clients are affected the same way (a first update can be lost).

This change registers the subscription (and the shared wrapped-chunk cache subscription) before upgrading, and releases them if the upgrade fails. Updates arriving before the writer goroutine starts are buffered in the queue and picked up via wake.

Verification: injecting a 50ms sleep between Upgrade and Subscribe on master reproduces the exact CI failure; with this change, the same sleep after Upgrade no longer causes failures. go test -cover ./pkg/api/ and go test -race -run Gsoc -count=5 ./pkg/api/ pass.

Open API Spec Version Changes (if applicable)

N/A

AI Disclosure

• This PR contains code that has been generated by an LLM.
• I have reviewed the AI generated code thoroughly.
• I possess the technical expertise to responsibly review the code generated in this PR.

🤖 Generated with Claude Code