ci: fix core-floor + full-stack test failures unblocked by lint fix

- core floor: @skip_no_stack the two stack-dependent autosync tests
  (test_sync_auto_toggle_*, test_run_once_runs_*) that import inspector.auth /
  routes.v2_api and fail with ModuleNotFoundError(fastapi) on the numpy-only gate.
  The pure policy tests still run on core floor; full-stack jobs run the rest.
- dashboard_v2: test_import_folder_route_rejects_path_outside_roots hardcoded
  tempfile.TemporaryDirectory(dir='C:\'), which is FileNotFoundError on Linux CI.
  Use C:\ on Windows, /tmp on POSIX so the 'outside the import roots' dir exists.
- sync: loads_strict relied on the JSON scanner raising RecursionError for deeply
  nested input, but Python 3.12 parses ~1000-deep input without raising, so the
  deep-nesting DoS guard (and its test) broke on 3.12. Add an explicit _scan_depth
  guard (_MAX_BUNDLE_DEPTH=200) so pathological bundles are rejected as ValueError
  on every Python version, not just where the scanner recurses.

ruff clean; affected suites pass (test_sync/autosync/dashboard_v2: 65 tests).

Author: Coding-Dev-Tools

engraphis/core/sync.py

@@ -264,14 +264,50 @@ def _reject_nonfinite(token: str):
     raise ValueError("non-finite JSON constant: %s" % token)
 
 
+_MAX_BUNDLE_DEPTH = 200  # generous; real bundles are shallow. Explicit DoS guard so
+# deeply-nested input is rejected on every Python version (3.12+'s JSON scanner no
+# longer raises RecursionError for ~1000-deep input, so we can't rely on that alone).
+
+
+def _scan_depth(s: str) -> int:
+    """Cheap max-nesting-depth scan that skips JSON string literals; used to reject
+    pathologically deep bundles without relying on the JSON scanner's RecursionError."""
+    depth = 0
+    max_depth = 0
+    in_str = False
+    esc = False
+    for ch in s:
+        if in_str:
+            if esc:
+                esc = False
+            elif ch == "\\":
+                esc = True
+            elif ch == '"':
+                in_str = False
+            continue
+        if ch == '"':
+            in_str = True
+        elif ch in "[{":
+            depth += 1
+            if depth > max_depth:
+                max_depth = depth
+        elif ch in "]}":
+            if depth > 0:
+                depth -= 1
+    return max_depth
+
+
 def loads_strict(data: bytes):
     """Parse untrusted bundle bytes, rejecting the non-standard ``Infinity``/``NaN``
     tokens Python's ``json`` accepts by default (they later raise ``OverflowError`` in
     ``int()`` and would otherwise abort the whole sync run). Deeply-nested input that
     would raise ``RecursionError`` in the JSON scanner is normalized to ``ValueError``
     so a single hostile bundle can't crash the whole sync run (DoS)."""
+    text = data.decode("utf-8")
+    if _scan_depth(text) > _MAX_BUNDLE_DEPTH:
+        raise ValueError("bundle JSON is nested too deeply")
     try:
-        return json.loads(data.decode("utf-8"), parse_constant=_reject_nonfinite)
+        return json.loads(text, parse_constant=_reject_nonfinite)
     except RecursionError:
         raise ValueError("bundle JSON is nested too deeply")
 

tests/test_autosync.py

@@ -67,6 +67,7 @@ def test_five_minute_floor_cannot_be_beaten():
         assert autosync.normalize_policy({"cadence_minutes": v})["cadence_minutes"] >= 5
 
 
+@skip_no_stack
 def test_sync_auto_toggle_is_admin_only_but_members_still_write():
     from engraphis.inspector.auth import min_role
     # Changing team auto-sync is admin-only; reading it stays viewer-visible.
@@ -105,6 +106,7 @@ def test_run_once_skips_without_license(tmp_path, monkeypatch):
     assert autosync.run_once(None).get("skipped") == "unlicensed"
 
 
+@skip_no_stack
 def test_run_once_runs_records_and_updates_button_state(tmp_path, monkeypatch):
     from engraphis import licensing as lic
     from engraphis.config import settings

tests/test_dashboard_v2.py

@@ -614,8 +614,12 @@ def test_import_folder_route_rejects_path_outside_roots(monkeypatch, tmp_path):
     This guards against path-traversal / symlink escapes.
     """
     import os
+    import sys
     import tempfile
-    with tempfile.TemporaryDirectory(dir="C:\\") as td:
+    # A directory genuinely OUTSIDE the import roots (HOME): C:\ is outside
+    # %USERPROFILE% on Windows; /tmp is outside /home on POSIX CI runners.
+    base = "C:\\" if sys.platform == "win32" else "/tmp"
+    with tempfile.TemporaryDirectory(dir=base) as td:
         outside = td
         os.makedirs(outside, exist_ok=True)
         test_file = os.path.join(outside, "test.md")