fix(plugins): resolve kvstore TTL flaky test due to second-boundary race

Changed the TTL expiration check from strict greater-than to greater-or-equal
in the notExpiredFilter SQL condition. SQLite's datetime has second-level
precision, so a 1-second TTL set late in a second could appear expired
immediately when read at the next second boundary (e.g. expires_at of T+1
fails the check 'T+1 > T+1'). Updated the cleanup query consistently to use
strict less-than, so rows are only deleted after their expiration second has
fully passed.

plugins/host_kvstore.go

@@ -25,7 +25,7 @@ const (
 )
 
 // notExpiredFilter is the SQL condition to exclude expired keys.
-const notExpiredFilter = "(expires_at IS NULL OR expires_at > datetime('now'))"
+const notExpiredFilter = "(expires_at IS NULL OR expires_at >= datetime('now'))"
 
 const cleanupInterval = 1 * time.Hour
 
@@ -349,7 +349,7 @@ func (s *kvstoreServiceImpl) cleanupLoop(ctx context.Context) {
 
 // cleanupExpired removes all expired keys from the database to reclaim disk space.
 func (s *kvstoreServiceImpl) cleanupExpired(ctx context.Context) {
-	result, err := s.db.ExecContext(ctx, `DELETE FROM kvstore WHERE expires_at IS NOT NULL AND expires_at <= datetime('now')`)
+	result, err := s.db.ExecContext(ctx, `DELETE FROM kvstore WHERE expires_at IS NOT NULL AND expires_at < datetime('now')`)
 	if err != nil {
 		log.Error(ctx, "KVStore cleanup: failed to delete expired keys", "plugin", s.pluginName, err)
 		return