fix(test): stop ai-summaries forbidden-word sweep timing out under load

[JSONbored]

Summary

• test/unit/ai-summaries.test.ts's "routes every forbidden public term through the canonical sanitizer and falls back when AI is unsafe" test iterates all 33 entries in FORBIDDEN_PUBLIC_COMMENT_WORDS, building a fresh createTestEnv() (via publicEnv()) on every single iteration.
• createTestEnv() constructs a new in-memory SQLite database and replays every migrations/*.sql file (166 of them) on construction (test/helpers/d1.ts) -- so the loop was rebuilding a fully-migrated database 33 times over for a test that only needs one shared database.
• This was previously masked by widening the timeout to an explicit 30s (commit 534dad77, alongside two sibling tests with the same symptom), but under sufficiently heavy concurrent load even 30s wasn't enough -- reproduced locally: an isolated run that normally passes in ~9s took 72s+ and failed on both the initial attempt and vitest's automatic retry.
• Fix: hoist the shared env/mock out of the loop so the database is built once, not 33 times. This is safe -- every iteration is expected to land on the "unsafe" branch, and sumAiEstimatedNeuronsSince only sums status: "ok" rows (src/db/repositories.ts), so the shared daily neuron budget never accumulates across words.
• Result: isolated runs dropped from ~9s (up to 72s+ under load) to under 1s (3 consecutive runs: 619ms, 318ms, 297ms), and a full unsharded npm run test:coverage pass (18,027 tests) shows no timeout on this test.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves -- not applicable; this is a maintainer-authored test-reliability fix, not a contributor PR under the linked-issue policy.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally -- test-only change to test/**, which Codecov does not measure, so there is no patch-coverage obligation.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries -- not applicable; no production code changed.

Additional validation beyond the standard checklist: ran the fixed test in isolation 3x consecutively (all under 1s, see Summary), ran the full test/unit/ai-summaries.test.ts file (all 47 tests pass), and ran a full local npm run test:ci pass -- fully green for this file. That gate run separately surfaced two unrelated, pre-existing flakes in test/unit/miner-attempt-worktree.test.ts and test/unit/miner-repo-clone.test.ts (same root class: real git subprocess work exceeding the default timeout under load), which are fixed in a separate companion PR rather than folded into this one.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. (Not applicable -- test-only change.)
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (Not applicable -- no such changes.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (Not applicable -- no such changes.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (Not applicable -- no UI changes.)
• Visible UI changes include a UI Evidence section below. (Not applicable -- no visible/UI changes.)
• Public docs/changelogs are updated where needed. (Not applicable.)

UI Evidence

Not applicable -- test-only change, no UI/frontend/docs surface touched.

Notes

• Companion PRs from the same investigation: a same-pattern timeout fix for test/unit/agent-sdk-driver.test.ts, and a same-pattern fix for the #5132 miner clone/worktree test suite.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.63%. Comparing base (25792fd) to head (6efc1ca).
⚠️ Report is 38 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6874   +/-   ##
=======================================
  Coverage   93.63%   93.63%           
=======================================
  Files         683      683           
  Lines       68164    68164           
  Branches    18706    18706           
=======================================
  Hits        63828    63828           
  Misses       3350     3350           
  Partials      986      986           

Flag	Coverage Δ
shard-1	43.23% <ø> (-0.46%)	⬇️
shard-2	36.99% <ø> (+0.25%)	⬆️
shard-3	32.64% <ø> (-0.12%)	⬇️
shard-4	34.41% <ø> (-0.40%)	⬇️
shard-5	31.46% <ø> (-0.33%)	⬇️
shard-6	45.87% <ø> (+0.41%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.