feat: make static analysis runtime configurable

[mohgupta-ship-it]

The fixed 30-second static-analysis allowance can truncate otherwise valid work even when the shared workflow has time remaining. Add SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT and raise its default to 300 seconds.

Static patterns and YARA continue to use the smaller of this configured allowance and the remaining workflow time. Invalid, zero, negative, infinite, or NaN values warn and retain the default. The setting is read at process startup, following the existing workflow-deadline convention. Other timeout layers are unchanged.

Tests cover fresh-process environment propagation, work lasting beyond the previous 30-second ceiling, tighter local and parent limits, YARA's integer timeout, invalid values, and retained incomplete-result behavior. Configuration does not replace the separate linear quote-scan fix in #521.

Validation:

• 720 focused configuration, YARA, reconstruction and workflow tests passed.
• Python 3.12 with locked dependencies: full make test-ci passed 4,029 tests, 14 skipped, 38 deselected, 4 expected failures; 89% coverage.
• A clean fixture completed with actual codex_cli and with --no-llm while using an explicit 45.5-second static setting; three semantic analyzer call-log entries succeeded in the live run.
• Fresh Linux/arm64 Docker build and both static repository smoke scans passed.
• Ruff lint/format, diff checks, DCO and committed secret scan passed.

Prepared by Codex on behalf of Mohit Gupta.

[rng1995]

[SkillSpector Review]

Reviewed head 5b81d8068e2671284dca86bf0276f1fbf39a0556 — APPROVE.

The configurable positive finite allowance is consistently shared by pattern and YARA analysis, remains capped by the workflow deadline, retains fail-closed partial accounting, and is documented and covered at process/configuration boundaries. I found no required changes in the current post-merge head.

Merge gate: GitHub reports mergeStateStatus=BLOCKED and no checks yet on the new merge commit. Wait for the required lint, unit, and DCO checks to run and pass before merging.

[rng1995]

[SkillSpector Review]

Re-reviewed current head 094023d2dbeaf8685e0821907f9bca14b4c07231 after the later main synchronizations. The configurable positive finite static-analysis allowance remains shared by pattern and YARA analysis, bounded by the remaining workflow deadline, fail-closed at exhausted or subsecond YARA budgets, documented, and covered at configuration and runtime boundaries. The integrated provider-documentation and reconstruction-hook changes do not conflict with this behavior. I found no required change.

Merge gate: GitHub currently reports no hosted checks on this exact head and mergeStateStatus=BLOCKED; required checks must run and pass before merging.