fix(thorchain): retry a failed keygen on the first retry tick, not the second

A keygen's result-validity window equalled ChurnRetryInterval, and both the churn pending-keygen check and the keygen-result handler treated the keygen as live at age == ChurnRetryInterval — exactly the first retry tick. The retry was therefore skipped as 'pending' and the first effective retry landed one tick later (2x the configured interval).

End the window one block before the retry tick so the keygen expires exactly as its retry fires. A stale result is rejected on that same block, so the retry cannot double-trigger a keygen whose result could still finalize a vault.

Unit tests cover the exact-boundary case on both the pending check and the result handler.