test: bound integration test timeout

[andrei-hasna]

Summary

• make the canonical repository test command use a finite 10-second per-test budget
• route CI and verify:release through that command
• add regression controls proving a legitimate process path can cross 5 seconds while explicit 100 ms hangs and immediate assertion failures still fail promptly
• make the release verifier reject timeout-budget drift

Root cause

The suite relied on Bun's 5000 ms default even though process and network-simulation tests legitimately approach or exceed it under release load. The reported publish gate measured the smart-SSH LAN-preference test at 5331.72 ms; one fixed sequential control in this change measured 5024.84 ms.

A preload-level setDefaultTimeout was tested and rejected because it overrode the narrower bun test --timeout 100 negative control. Keeping the budget in the canonical package command preserves narrower per-test and command-line limits.

Verification

• regression before fix: the 5.2-second process control timed out at 5000ms
• shared harness controls: 4 passed, 0 failed
• smart-SSH LAN-preference control: 3 sequential passes, including 5024.84ms
• affected SSH/MCP/manifest CLI lanes: 55 passed, 0 failed
• bun run typecheck: passed
• bun run verify:release: passed twice; each run completed 577 tests, build, consumer conformance, and release verification
• staged Shield review: no security issues
• staged and commit-range Gitleaks: no leaks

Task: OPE34-00026

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #88 @ cc2cb5c — lens: correctness+security+gates, reviewer Xenon (1 of 1)

Reviewed the exact change from freshly fetched origin/main b07b2c8 through head cc2cb5c. I read the complete diff and surrounding source for .github/workflows/ci.yml, package.json, scripts/verify-release.ts, and test/test-harness.test.ts, plus every repository reference to bun test, bun run test, verify:release, and the new timeout.

Commands and results:

• bun install — exit 0. Setup only; not counted as a repository gate.
• bun run typecheck — exit 0. Counts: not applicable; tsc --noEmit emitted no diagnostics.
• bun run test — exit 0. 577 pass, 0 fail, 64 files, 46.65s.
• git diff --check origin/main...HEAD — exit 0. Supplemental diff-hygiene check, not a declared package gate.

Security/correctness trace: this change only routes CI and release verification through the canonical package test script, gives each Bun test a finite 10-second budget, and adds a harness regression test. It changes no runtime input, authorization, secret handling, network exposure, persistent data, mutation, or rollback path.

Blocking P0/P1 findings: none.

Non-blocking follow-up: test/test-harness.test.ts leaves its two temporary fixture directories under the OS temp directory. This is bounded test-run cleanup hygiene and does not affect the declared gates or shipping behavior.