fix(test): stop the local gate from failing on main (#5725)

Three independent, pre-existing gate breaks, none introduced by this branch --
found while chasing why release-please's PRs (#5710-5713) looked flaky under
local parallel test runs, and confirmed to reproduce identically on a clean
origin/main checkout:

- test/unit/agent-sdk-driver.test.ts, ai-summaries.test.ts, upstream-ruleset.test.ts:
  each does real, non-trivial work (git subprocess round-trips, a 42-entry
  forbidden-word sweep, 29 sequential D1-backed scenarios) that reliably exceeds
  vitest's 15s default under load. Widened each to an explicit, realistic timeout
  instead of leaving them to flake.
- test/unit/selfhost-grafana-dashboard.test.ts: 5f187c2 (#5716) fixed a real
  production bug -- Grafana's ${var:sqlstring} doesn't sql-quote a value that
  starts with $__, so the old $__all "All repos" sentinel leaked through
  unescaped and SQLite misparsed it as its own bind parameter, silently zeroing
  every "All"-filtered panel. That commit updated the dashboard JSON and two
  sibling test files but missed this one.
- apps/gittensory-ui/public/openapi.json + 3 route/component .tsx files:
  40e6cdf (#5715, the @gittensory -> @Loopover bot-mention rename) changed
  copy text but never regenerated the OpenAPI spec or ran prettier on the
  reflowed JSX text nodes, so ui:openapi:check and ui:lint both fail on main.

Regenerated the spec (npm run ui:openapi) and ran eslint --fix on the affected
files; both are mechanical, zero-semantic-diff outputs.

Author: JSONbored

test/unit/agent-sdk-driver.test.ts

@@ -88,6 +88,11 @@ describe("createAgentSdkCodingAgentDriver", () => {
   });
 
   it("enumerates tracked and untracked worktree changes with git", async () => {
+    // Real subprocess spawns (init, 2x config, add, commit, plus the driver's own diff enumeration) --
+    // legitimately more wall-clock latency than the default 15s test timeout reliably covers under
+    // concurrent CI shard/system load (observed timing out under heavy parallel contention with no logic
+    // failure; passes in well under 1s in isolation). An explicit timeout says so instead of relying on
+    // ambient headroom.
     const dir = await mkdtemp(join(tmpdir(), "gittensory-agent-sdk-"));
     try {
       await execFileAsync("git", ["init"], { cwd: dir });
@@ -114,7 +119,7 @@ describe("createAgentSdkCodingAgentDriver", () => {
     } finally {
       await rm(dir, { recursive: true, force: true });
     }
-  });
+  }, 30000);
 
   it("derives changed files from the worktree after untracked mutating tools", async () => {
     const driver = driverWith({

test/unit/ai-summaries.test.ts

@@ -409,12 +409,16 @@ describe("optional deterministic-summary rewrite layer", () => {
   });
 
   it("routes every forbidden public term through the canonical sanitizer and falls back when AI is unsafe", async () => {
+    // Iterates every entry in FORBIDDEN_PUBLIC_COMMENT_WORDS (40+ words) as its own real round trip through
+    // rewriteSignalBundleWithAi -- legitimately more work than the default 15s test timeout reliably covers
+    // under load (observed timing out under concurrent CI shard contention, not a logic failure: every
+    // assertion that DID run passed). An explicit timeout says so instead of relying on ambient headroom.
     for (const word of FORBIDDEN_PUBLIC_COMMENT_WORDS) {
       const run = vi.fn(async () => ({ response: `Looks great, includes ${word} detail.` }));
       const result = await rewriteSignalBundleWithAi(publicEnv({}, run), rewriteReq());
       expect(result, `forbidden word: ${word}`).toMatchObject({ status: "unsafe", text: DETERMINISTIC_BODY });
     }
-  });
+  }, 30000);
 
   it("rejects reward, ranking, scoreability, and reviewability variants in public AI rewrites", async () => {
     const unsafeOutputs = [

test/unit/upstream-ruleset.test.ts

@@ -1085,6 +1085,10 @@ describe("upstream ruleset drift tracking", () => {
     expect(calls.find((call) => call.method === "POST")?.body?.assignees).toEqual(["alice", "bob"]); // trimmed, empty segment dropped
   });
 
+  // 29 distinct real-D1-backed scenarios run sequentially in this one test -- legitimately more work than
+  // the default 15s test timeout reliably covers under concurrent CI shard/system load (observed timing out
+  // under heavy parallel contention with no assertion failure). An explicit timeout says so instead of
+  // relying on ambient headroom.
   it("handles edge cases while filing upstream drift issues", async () => {
     const defaultRepoEnv = createTestEnv({ GITTENSORY_AUTO_FILE_DRIFT_ISSUES: "1", GITTENSORY_DRIFT_ISSUE_TOKEN: "token", GITTENSORY_DRIFT_ISSUE_REPO: "" });
     await upsertUpstreamDriftReport(defaultRepoEnv, driftReport("source-fingerprint", { severity: "medium", affectedAreas: [] }));
@@ -1225,7 +1229,7 @@ describe("upstream ruleset drift tracking", () => {
     const disabledEnv = createTestEnv();
     delete (disabledEnv as Partial<Env>).GITTENSORY_AUTO_FILE_DRIFT_ISSUES;
     await expect(fileUpstreamDriftIssues(disabledEnv)).resolves.toMatchObject({ status: "disabled" });
-  });
+  }, 45000);
 
   it("finds the existing drift issue on page 2 when the repo has more than 100 open signals issues", async () => {
     const env = createTestEnv({ GITTENSORY_AUTO_FILE_DRIFT_ISSUES: "true", GITTENSORY_DRIFT_ISSUE_TOKEN: "token" });