T 1532290: Back refreshClaimCoordinationEnabled with a lock for cross-thread runtime toggling

[vishal-mb]

Summary

• Back refreshClaimCoordinationEnabled with a lock. Hosts may toggle it at runtime while request pipelines read it from their own queues; a plain static Bool made that a data race. No API change.
• Fix testBlockingTimeout flakiness. Blocking begin's semaphore and URLSession's task timeout both use timeoutIntervalForRequest and race, so the thrown error type depended on which fired first; URLError.timedOut is now normalized to .requestTimeout, and the test uses a stalled URLProtocol instead of a live server.

Test Plan

Full suite 231/231, SwiftLint 0 warnings; testBlockingTimeout deterministic across repeated runs.

Security Impact

No security impact — synchronization and error-normalization of existing behavior.

[AnshulMindbody]

Looks good to me. Both access paths use the same lock, and it is released before any refresh work or callbacks run, so the runtime toggle is race-free without introducing lock-order or reentrancy risk. The public API and default remain unchanged, and the timeout normalization matches the blocking API's documented contract. I ran all 231 tests locally and repeated the timeout test 20 times; everything passed.