fix: bound ntfy read-back in doorbell heartbeat (avoid hang)

infra/doorbell-listener/scripts/kuma-heartbeat.sh

@@ -21,14 +21,17 @@ else
     #    without us owning the service.
     marker="canary-$(date +%s)-$$"
     url="https://ntfy.sh/${CANARY_TOPIC}"
-    if ! curl -fsS -m 10 -o /dev/null -X POST "$url" -d "$marker" 2>/dev/null; then
+    if ! curl -fsS -m 10 -o /dev/null -X POST "$url" -H "id: $marker" -d "$marker" 2>/dev/null; then
         reason="${reason}ntfy_publish_failed"
     else
-        sleep 1
-        body=$(curl -fsS -m 10 "$url/json" 2>/dev/null)
-        if [ -z "$body" ] || ! printf '%s' "$body" | grep -qF "$marker"; then
+        # Read back with poll+since, bounded by --max-time so the ntfy.sh
+        # stream doesn't hang the probe (plain /json keeps the connection open).
+        tmp=$(mktemp)
+        curl -fsS --max-time 5 "$url/json?poll=1&since=$(($(date +%s)-5))" -o "$tmp" 2>/dev/null
+        if ! grep -qF "$marker" "$tmp"; then
             reason="${reason}ntfy_echo_missing"
         fi
+        rm -f "$tmp"
     fi
 fi