Librarian: answer each query back to the bot that sent it

So one librarian can serve several bots (test + deploy) instead of firing
every result/pong at a single static CONJURER_MAIN_BOT.

* The bot includes its own callback address (CONJURER_SELF_CALLBACK) in
  every /query and /ping.
* The librarian stores that callback with the query (persisted with the
  request, so a replay after restart still answers the right bot) and, for
  results, in the OUTBOX entry ({target, payload}) so the resender delivers
  to the origin bot even across a librarian restart.
* Pongs go back to the pinging bot too - otherwise a second bot's health
  check would be ponged to the first and always time out, so it could
  never enable its librarian cog.
* Empty callback falls back to MAIN_BOT_ADDRESS, and a legacy OUTBOX entry
  (raw payload, pre-callback) is still delivered to the default bot, so the
  upgrade is seamless.

Tests: per-origin result delivery + legacy-shape fallback (outbox),
busy/idle pong routed to the callback bot vs default (lifecycle). Suite:
58 unit + 52 integration green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/integration/test_librarian_query_lifecycle.py

@@ -58,15 +58,19 @@ def test_ping_idle_routes_through_internal_queue(monkeypatch):
     monkeypatch.setattr(lib.requests, "post", lambda *a, **k: posted.append((a, k)))
     client = _client()
 
-    resp = client.post("/ping", json={"UUID": "ping-idle"})
+    resp = client.post("/ping", json={"UUID": "ping-idle", "callback": "http://bot-a:5000"})
 
     assert resp.status_code == 200
-    # Idle => it went onto the internal queue for the worker, NOT posted directly.
+    # Idle => it went onto the internal queue for the worker (carrying the
+    # callback so the worker pongs the right bot), NOT posted directly.
     assert posted == []
-    assert lib.librarian_queue.get_nowait() == {"__ping__": "ping-idle"}
+    assert lib.librarian_queue.get_nowait() == {
+        "__ping__": "ping-idle",
+        "callback": "http://bot-a:5000",
+    }
 
 
-def test_ping_while_busy_pongs_directly_without_queue(monkeypatch):
+def test_ping_while_busy_pongs_directly_to_the_pinging_bot(monkeypatch):
     _reset()
     lib.worker_busy.set()  # a search is grinding
     posted = []
@@ -81,15 +85,33 @@ def test_ping_while_busy_pongs_directly_without_queue(monkeypatch):
     monkeypatch.setattr(lib.requests, "post", fake_post)
     client = _client()
 
-    resp = client.post("/ping", json={"UUID": "ping-busy"})
+    resp = client.post("/ping", json={"UUID": "ping-busy", "callback": "http://bot-b:5000"})
 
     assert resp.status_code == 200
-    # Busy => direct pong back to the bot, and NOTHING queued (it would only wait
-    # behind the long search).
+    # Busy => direct pong, NOTHING queued, and it goes to the CALLBACK bot (not
+    # the static default) so a shared librarian health-checks each bot correctly.
     assert lib.librarian_queue.empty()
     assert len(posted) == 1
     assert posted[0]["json"] == {"__pong__": "ping-busy"}
-    assert posted[0]["url"].endswith(lib.SEND_RESULTS)
+    assert posted[0]["url"] == "http://bot-b:5000" + lib.SEND_RESULTS
+
+
+def test_ping_without_callback_pongs_to_default_bot(monkeypatch):
+    _reset()
+    lib.worker_busy.set()
+    posted = []
+
+    class _Resp:
+        status_code = 200
+
+    monkeypatch.setattr(
+        lib.requests, "post",
+        lambda url, **k: posted.append(url) or _Resp(),
+    )
+    client = _client()
+    client.post("/ping", json={"UUID": "ping-nocb"})  # no callback
+
+    assert posted == [lib.MAIN_BOT_ADDRESS + lib.SEND_RESULTS]
 
 
 def test_query_status_enforces_api_key():