fix(upstream): fail-closed when ruleset generatedAt is unparseable

[kiannidev]

Problem

loadUpstreamStatus treats a ruleset snapshot as current when generatedAt is missing or malformed. Date.parse returns NaN, the stale comparison is false, and operators see a fresh upstream status on corrupted snapshot data.

Expected behavior

Unparseable or missing generatedAt should resolve to stale (fail-closed), matching the guard pattern already used in src/github/backfill.ts (Number.isFinite(ageMs)).

Scope

• Add a shared staleness helper in src/upstream/ruleset.ts
• Update loadUpstreamStatus status resolution
• Regression tests in test/unit/upstream-ruleset.test.ts for garbage ISO, empty string, and valid timestamps

Acceptance criteria

• Malformed generatedAt → status: "stale" (when no drift reports)
• Valid recent timestamp → status: "current"
• Valid old timestamp beyond UPSTREAM_STALE_MS → status: "stale"
• Full npm run test:ci green

[JSONbored]

Closing as completed (2026-07-01 issue audit): Ruleset unparseable-generatedAt fail-closed fixed in #1686 (src/upstream/ruleset.ts Number.isFinite guard).