chore(audit): workflow-timeout + override-parity guardrails, OAuth state hardening

[agjs]

Summary

Executes all 3 findings from today's monorepo audit on one branch. Guardrail-first: 2 of 3 fixes ship as new lint-meta rules that surfaced (and now block) the whole defect class — the rules found 3 more real instances than the audit itself.

F001 — fix(ci): workflow jobs must declare timeout-minutes (7b62f8c)

• New github-actions-timeout-required lint-meta rule in both apps (jobs without a timeout run to GitHub's 6h default and block PR checks; reusable-workflow calls exempt).
• Workflow discovery now walks up to the repo-root .github/workflows — per-app lint-meta looked for <app>/.github/workflows, which doesn't exist in the monorepo layout, so the existing github-actions-permissions rule (SHA pins + permissions blocks) was silently scanning an empty set. It now actually enforces against all 23 workflows. Standalone split-out repos are unaffected (the fallback never triggers).
• Fixes the two jobs the rule surfaced: apps-docs-linkcheck (20m) and infra-bootstrap-validate (10m).

F002 — fix(deps): security-override parity across apps (bf69ffa)

• New package-override-parity lint-meta rule (api, supply-chain): an app's overrides must be reflected in its own bun.lock and mirrored by sibling apps that resolve the same package.
• The rule surfaced three real instances (the audit had found one):
  • ui resolved ws@8.20.1/7.5.10 with no mirror of the docs ws@8.21.0 pin (GHSA-58qx-3vcg-4xpx) → mirrored.
  • ui resolved qs@6.15.1 with no mirror of the docs qs@6.15.2 pin (GHSA-q8mj-m7cp-5q26) → mirrored.
  • docs' bun.lock resolved @types/react@19.2.14 despite its own 19.2.15 override (stale resolution) → re-resolved.
• Note: the ws pin forces lighthouse's exact ws@7.5.10 up to 8.21.0 — security over local-only dev tooling; docs made the identical call. Revisit if bun run lighthouse regresses.

F003 — fix(api): reject malformed OAuth state (2666bfe)

• oauthStateStore.consume() returned {} when the stored Valkey value failed JSON.parse or wasn't an object — indistinguishable from a legitimately stored empty state. Corrupted state now routes through the same null rejection path as forged/expired state (→ 401).
• Adds the missing oauth.state.test.ts (round-trip, replay burn, garbage, JSON scalar, unknown-field stripping).

Audit decisions log: .audit/execution-summary.json (gitignored, local). The report's 7 blocked_or_uncertain items were skipped by design (they need evidence/maintainer decisions, not code).

Test plan

• bun run check green in apps/api and apps/ui; bun run check:docs-data green in apps/docs
• Full api suite: 1069 tests / 1365 expects, 0 fail (includes 5 new oauth.state tests, 5 new lint-meta rule tests)
• RED→GREEN proven for both new rules: each flagged the exact known instances before the fix, zero violations after
• Pre-push gate (security, docs, root fan-out) passed on push
• Stack smoke not run — no compose/infra runtime changes (workflow YAML only)

Conventions

• No any, no blind as, no !
• No new env vars (schema/.env.example untouched)
• Tests updated for changed behavior (new rule tests in both apps + oauth.state.test.ts)

Screenshots

n/a — CI/lint-meta/API-internal changes only.