[1dae04a7] Video: release 0.25.0 (revision) (#536)

* fix(release): CI wait polls the prod rung; escape the header tooltip apostrophe

get_latest_ci_conclusion defaults to the ladder's head rung, so
wait_for_ci searched slave for a release commit that lives on master
and timed out after 40 minutes with the run already green. The wait
now passes the prod branch explicitly. Also fixes the
react/no-unescaped-entities error that turned master's Panel CI red.

* fix(panel,video): dead dialog triggers behind tooltips; dotted composition ids render

HelpTip nested inside a Dialog/AlertDialog trigger puts the trigger's
click handler on the Tooltip root, which renders no DOM — the agents
Spawn item and the KB Reindex-All / Delete-index confirms were dead.
Tooltips now wrap the triggers. The video renderer accepts interior
single dots in composition ids (release-0.25.0) with '..' still
unrepresentable, and propose_video refuses an unrenderable id at
authoring time.

* fix(dispatch): restart-safe PM review turns

A leaf task in awaiting_pm_review had no periodic pickup: the closure
dispatcher bailed on childless tasks and skipped PR-bearing review
tasks as already-promoted, assuming the submit-time PM session was
still alive — an assumption every restart breaks. Proven live on the
docs-sync leaf after the 0.25.0 redeploy, which also dependency-blocked
its sibling dev task. Childless awaiting_pm_review tasks now flow to
the PM's review turn, and the merge turn respawns its PM when none is
active.

* [1dae04a7] Revise release-0.25.0 composition to 40s scene-based pacing with four feature cards

* [1dae04a7] docs(motion): update release-0.25.0 README section for 40s four-card revision

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>
Co-authored-by: UX/UI Developer 1 <ux-dev-1@roboco.tech>
Co-authored-by: UX/UI Documenter <ux-doc@roboco.tech>

video-renderer/server.js

@@ -24,7 +24,10 @@ const PORT = Number(process.env.PORT ?? 3001);
 // safe path segment so a ".." / "/" / absolute-path value can't escape the
 // composition dir (path traversal). The orchestrator only ever sends a real
 // composition id, but this is the trust boundary — validate here.
-const COMPOSITION_ID_RE = /^[A-Za-z0-9_-]+$/;
+// Letters/digits/_/- plus interior single dots (e.g. release-0.25.0).
+// No leading dot and no adjacent dots, so '.'/'..' path segments and
+// hidden-file names remain unrepresentable — this stays the trust boundary.
+const COMPOSITION_ID_RE = /^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*$/;
 
 // motion/ source (no node_modules, no build output) is a few hundred KB in
 // practice; this cap is generous headroom, not a tuned budget.
@@ -74,7 +77,7 @@ app.post("/render", renderLimiter, upload.single("source"), async (req, res) =>
   ) {
     res.status(400).json({
       error:
-        "'composition_id' must be a non-empty string of letters, digits, '_' or '-'",
+        "'composition_id' must be letters, digits, '_' or '-', with optional interior dots",
     });
     return;
   }