fix(release): close the 0.19.0 scan findings — sandbox mongo tag, flow-verb timeout walls, video hardening (#329)

- mongo:8-alpine → mongo:8 (tag never existed; a mongo-opted project could spawn no agents) + a Docker Hub tag-existence e2e guard for every sandbox engine
- flow-verb timeouts at both walls: shared SLOW_VERBS policy (i_am_done / submit_up / submit_root / open_pr / i_will_work_on get the 900s server budget); the MCP client now outlasts the server budget (+10s headroom, orchestrator-injected env) so agents receive the middleware's clean 504 envelope instead of dying at the old flat 30s client timeout
- cancellation safety: the quality gate kills+reaps its child on CancelledError; create_pr records the PR via a shield-with-wait-out helper so the write can neither be skipped nor race get_db's rollback
- video engine: renderer sidecar isolated on a render-only network, 2g/2cpu caps, 570s render watchdog with exit-on-hang, 512MB tar decompression cap, CEO notification on terminal render failure, reject under the approve mutex (fail-closed on Redis-down)
- dead python-jose dependency removed (drops ecdsa and its unfixable Minerva advisory PYSEC-2026-1325); panel --font-mono now a real monospace stack

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

video-renderer/server.js

@@ -10,7 +10,12 @@ import express from "express";
 import multer from "multer";
 import rateLimit from "express-rate-limit";
 import { createReadStream } from "node:fs";
-import { renderComposition, UnknownCompositionError } from "./render.js";
+import {
+  renderComposition,
+  ExtractedSizeExceededError,
+  RenderTimeoutError,
+  UnknownCompositionError,
+} from "./render.js";
 
 const PORT = Number(process.env.PORT ?? 3001);
 
@@ -123,10 +128,24 @@ app.post("/render", renderLimiter, upload.single("source"), async (req, res) =>
     });
     stream.pipe(res);
   } catch (err) {
-    if (err instanceof UnknownCompositionError) {
+    if (
+      err instanceof UnknownCompositionError ||
+      err instanceof ExtractedSizeExceededError
+    ) {
       res.status(err.statusCode).json({ error: err.message });
       return;
     }
+    if (err instanceof RenderTimeoutError) {
+      console.error("video-renderer: render timed out", err.message);
+      res.status(500).json({ error: err.message });
+      // ponytail: Promise.race in render.js abandons the wait but can't
+      // cancel a wedged headless-Chrome render tree — hard-exiting this
+      // process is the only reliable kill. Docker's restart policy brings
+      // up a clean container; wait for the response to flush first so the
+      // caller still gets the 500 instead of a dropped connection.
+      res.on("finish", () => process.exit(1));
+      return;
+    }
     const message = err instanceof Error ? err.message : String(err);
     console.error("video-renderer: render failed", message);
     res.status(500).json({ error: `render failed: ${message}` });