fix(release): close the 0.19.0 scan findings — sandbox mongo tag, flow-verb timeout walls, video hardening (#329)

- mongo:8-alpine → mongo:8 (tag never existed; a mongo-opted project could spawn no agents) + a Docker Hub tag-existence e2e guard for every sandbox engine
- flow-verb timeouts at both walls: shared SLOW_VERBS policy (i_am_done / submit_up / submit_root / open_pr / i_will_work_on get the 900s server budget); the MCP client now outlasts the server budget (+10s headroom, orchestrator-injected env) so agents receive the middleware's clean 504 envelope instead of dying at the old flat 30s client timeout
- cancellation safety: the quality gate kills+reaps its child on CancelledError; create_pr records the PR via a shield-with-wait-out helper so the write can neither be skipped nor race get_db's rollback
- video engine: renderer sidecar isolated on a render-only network, 2g/2cpu caps, 570s render watchdog with exit-on-hang, 512MB tar decompression cap, CEO notification on terminal render failure, reject under the approve mutex (fail-closed on Redis-down)
- dead python-jose dependency removed (drops ecdsa and its unfixable Minerva advisory PYSEC-2026-1325); panel --font-mono now a real monospace stack

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

roboco/mcp/do_server.py

@@ -35,6 +35,13 @@ AGENT_ID = os.environ["ROBOCO_AGENT_ID"]
 AGENT_ROLE = os.environ["ROBOCO_AGENT_ROLE"]
 
 _TIMEOUT = 30
+# commit() stages + `git commit`s in-process (no push — push is the flow
+# verb open_pr, already covered by flow_server's per-verb timeout), bounded
+# server-side by git_commit_timeout_seconds (default 180s: a large changeset,
+# e.g. the panel's hundreds of files, can legitimately take that long). The
+# shared _TIMEOUT above is tuned for fast content-tool calls (note/dm/
+# evidence) and would give up first — client must outlast the server op.
+_COMMIT_TIMEOUT = 190
 # Tight timeout for SDK loopback — local sidecar; gateway path must not stall.
 _SDK_TIMEOUT = 2.0
 # FastAPI's default missing-route status. Every /api/v1/do/* route returns
@@ -247,7 +254,9 @@ def _build_headers() -> dict[str, str]:
     return headers
 
 
-def _post(path: str, body: dict[str, Any]) -> dict[str, Any]:
+def _post(
+    path: str, body: dict[str, Any], *, timeout: float = _TIMEOUT
+) -> dict[str, Any]:
     """POST a request to the orchestrator and return the JSON envelope.
 
     Mirrors flow_server._post: surfaces the orchestrator's envelope on
@@ -260,8 +269,11 @@ def _post(path: str, body: dict[str, Any]) -> dict[str, Any]:
     REPLACED with circuit_open. Dogfooding surfaced the gap: do-server had
     no breaker and `note(scope='decision')` looped 8 times returning
     incomplete_input.
+
+    ``timeout`` overrides the default for a slow tool (e.g. commit's
+    _COMMIT_TIMEOUT) — must always outlast that tool's server-side budget.
     """
-    with httpx.Client(timeout=_TIMEOUT) as client:
+    with httpx.Client(timeout=timeout) as client:
         response = client.post(
             f"{ORCHESTRATOR_URL}{path}",
             headers=_build_headers(),
@@ -434,7 +446,11 @@ def _record_and_check_circuit(
 
 def commit(message: str, files: list[str] | None = None) -> dict[str, Any]:
     """Make a git commit. [task-id] prefix auto-applied. Validates message."""
-    return _post("/api/v1/do/commit", {"message": message, "files": files})
+    return _post(
+        "/api/v1/do/commit",
+        {"message": message, "files": files},
+        timeout=_COMMIT_TIMEOUT,
+    )
 
 
 def note(