fix: preserve manual-control button requests and close WebSocket cleanly

[yeseorizi]

Problem

Short keyboard presses can reach /keyboard_joy but be overwritten by their release before the 20 Hz control timer samples them. A delayed arm/mode service response can also cause a later request to be discarded. Separately, the WebSocket server can continue publishing after the ROS context shuts down, and malformed JSON uses an unsupported logger method.

Changes

• Consume button edges in the Joy callback, with separate history for keyboard and joystick inputs. Keep axis sampling and the 0.3 s neutral timeout unchanged.
• Retain only the latest pending mode request, expiring it after 2 s. Do not queue arm requests; hand a pending disarm to the service after the earlier arm response completes. Log the actual request associated with each response.
• Close WebSocket intake/connections before destroying the ROS node/context; allow shutdown handling during a backlog; use logger.warning for malformed JSON.
• Add 46 pytest cases and register them with CTest. No topic, axis, button mapping, Docker or deployment changes.

Validation

Base: 23bb608a9a89b9cda3472792316a81711f1ce73e (after camera PR #5).
Apple M2 host, Linux ARM64 Docker, ROS 2 Lyrical / Gazebo Jetty. No physical vehicle or gamepad.

• Earlier same-input keyboard comparison: Joy arrived 80/80 in every run; service requests were 54/80 on main, then 80/80 in each of two corrected runs.
• Fresh independent build of this PR: 46/46 unit tests. colcon test-result reports 49 including three CTest wrappers, not 49 independent tests.
• This PR alone, without local plugin-shutdown or ros_gz fixes: 15/15 WebSocket runs (normal, malformed JSON, disconnect/reconnect, backlog + SIGINT, backlog + SIGTERM), valid payloads and exit 0 within the unchanged 4 s limit.
• This PR alone: BlueROV2 → ArduSub SITL → MAVROS → Gazebo run; all 12 sampled command phases matched their expected values, and final disarm was confirmed. This is input-path verification, not a hard real-time guarantee.

Limits / unrelated failures retained

The standalone Gazebo run also recorded one heartbeat timeout, the existing headless GUI-camera timeout, and a stock ros_gz_bridge SIGSEGV at shutdown. These are not claimed as fixed by this PR. Earlier combined-overlay and browser results are supplementary, not the basis for independent shutdown claims. Windows/AMD64 and physical-gamepad validation remain outside this local test.

Pending disarm still depends on the earlier service response; it is not an emergency stop and cannot guarantee completion if that service never responds.

Run the committed regression tests

colcon build --packages-select posim_robot_models --cmake-args -DBUILD_TESTING=ON
colcon test --packages-select posim_robot_models --event-handlers console_direct+
colcon test-result --verbose

Please review; no merge or release is requested by this validation run.

CI infrastructure note (2026-10-08)

ARM64 run 37743078860 stopped in the runner-admin pre-job hook, before checkout/build: ~61.15 GiB free vs its 80 GiB minimum. This is not a compiler/test result for this change. No runner files, free-space thresholds, or maintenance hooks were changed. ARM64 CI remains unverified until the runner is ready; the Docker workflow does not publish PR images.