Writer lease follow-ups: renewal after a lock wait, watchdog after drain, retry timer on failed startup #490

Follow-ups from the writer-lease fix (#486, #487):

1. Renewal can extend a lease that expired while the renewal waited on a row lock held by a session that only locked the row (acquire's FOR UPDATE finding a live lease): PostgreSQL doesn't recheck the expiry predicate after such a wait. No second writer results, but the renewal should lock first and then check expiry.
2. A renewal that completes after drain() cleared the watchdog arms a new one.
3. The startup-failure path doesn't clear the lease retry timer.