Make the hdp-mcp expired-record test deterministic

[asiridalugoda]

Makes the hdp-mcp test "does not treat an expired record as an integrity failure" deterministic. Test-only change.

The test waited with one setTimeout until just past header.expires_at, then asserted expires_at < Date.now(). Node timers can fire about 1 ms early, so Date.now() could equal expires_at and the strict assertion failed. This happened on public CI run 37796834941 (Node 22): expected 1791471505561 to be less than 1791471505561.

The test now waits in 1 ms steps until Date.now() is past expires_at, so the strict assertion holds by construction. What the test proves is unchanged: an expired, correctly signed record is reported through onValid, onInvalid is not called, and the handler runs.

Verification:

• The focused test passed 200 consecutive runs on Node 22 and on Node 26, and 30 more in a separate check; the hdp-mcp suite passes (14 tests); root tests pass on Node 20 and 22.
• With the middleware temporarily changed to report an expired token to onInvalid, the test fails (onValid not called); the change was reverted and confirmed clean before the green runs.