fix(release): close the 0.19.0 scan findings — sandbox mongo tag, flow-verb timeout walls, video hardening (#329)

- mongo:8-alpine → mongo:8 (tag never existed; a mongo-opted project could spawn no agents) + a Docker Hub tag-existence e2e guard for every sandbox engine
- flow-verb timeouts at both walls: shared SLOW_VERBS policy (i_am_done / submit_up / submit_root / open_pr / i_will_work_on get the 900s server budget); the MCP client now outlasts the server budget (+10s headroom, orchestrator-injected env) so agents receive the middleware's clean 504 envelope instead of dying at the old flat 30s client timeout
- cancellation safety: the quality gate kills+reaps its child on CancelledError; create_pr records the PR via a shield-with-wait-out helper so the write can neither be skipped nor race get_db's rollback
- video engine: renderer sidecar isolated on a render-only network, 2g/2cpu caps, 570s render watchdog with exit-on-hang, 512MB tar decompression cap, CEO notification on terminal render failure, reject under the approve mutex (fail-closed on Redis-down)
- dead python-jose dependency removed (drops ecdsa and its unfixable Minerva advisory PYSEC-2026-1325); panel --font-mono now a real monospace stack

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/unit/runtime/test_spawn_strict_mcp.py

@@ -14,6 +14,7 @@ from pathlib import Path
 from unittest.mock import patch
 
 import pytest
+from roboco.config import settings
 from roboco.models.runtime import OrchestratorAgentConfig, SpawnGitContext
 from roboco.runtime.orchestrator import AgentOrchestrator
 
@@ -102,3 +103,19 @@ class TestMcpConfigPinsBakedVenv:
                 f"a drifted workspace-clone lock can't trigger a resync stall; "
                 f"got args={spec['args']}"
             )
+
+    @pytest.mark.asyncio
+    async def test_mcp_env_mirrors_flow_verb_timeout_settings(self) -> None:
+        """flow_server.py (a subprocess, can't read Settings) mirrors the two
+        server-side flow-verb timeout budgets via env so its client timeout
+        stays coherent with operator tuning of either setting."""
+        orch = AgentOrchestrator.__new__(AgentOrchestrator)
+        config_path = await orch._generate_mcp_config("be-dev-1")
+        config = json.loads(Path(config_path).read_text())
+        env = config["mcpServers"]["roboco-flow"]["env"]
+        assert env["ROBOCO_FLOW_VERB_TIMEOUT_SECONDS"] == str(
+            settings.flow_verb_timeout_seconds
+        )
+        assert env["ROBOCO_FLOW_VERB_SLOW_TIMEOUT_SECONDS"] == str(
+            settings.flow_verb_slow_timeout_seconds
+        )