fix: expire oid4vci recovery state on a test clock and gate unlisted citation roots

[jeremi]

Two CI reliability fixes from the merge run of #1071, #1074, and #1087.

test(oid4vci): expire recovery state on a clock the test moves

Closes #1066.

expiry_cleanup_preserves_live_state_and_releases_expired_state configured a one-second offer window and slept past it. Store deadlines are whole Unix seconds, so state created just before a boundary held almost none of its window, and a loaded runner spent the rest: the supposedly live redemption came back 400. It failed again on 2026-09-15 on #1074, which touches nothing in this crate.

DeliveryService now holds the function it reads the current second from, and the recovery tests move their own reading forward instead of sleeping. They run on lifetimes a deployment may actually configure (the old 1s and 5s values are outside StoreConfig::validate()'s 60..=900 range), and a wallet proof is dated by the same reading the service judges it against. The preserved assertions are unchanged: an expired redemption stays indistinguishable from an unknown code, two live offers still fit only if the expired one was pruned, and the live redemption still returns 200.

The same rewrite covers the access-token and nonce parts of that test and the sibling token_saturation_does_not_spend_the_offer_that_could_not_be_exchanged, which carried a 5.1s sleep with the same hazard. The recovery suite drops from about 11s of sleeps to 0.18s.

Security review note. This touches expiry enforcement. The seam is built to be unreachable from a deployment: DeliveryService::load installs the system clock, with_clock is hidden from the documented surface and reachable only through with_halves, which already takes the authorizer and issuer and is strictly more powerful. No configuration key selects a clock. store.rs is untouched and still expires an entry when expires_at <= now.

fix(docs): fail the evidence-anchor checker on an unlisted top-level directory

A citation into a top-level directory REPOSITORY_ROOTS omits parses as no citation at all, so its anchor is checked against nothing. That invariant was only asserted by a test in the docs suite, which runs in the path-filtered Docs checks job.

#1071 added the tracked top-level directory scripts/ while touching only scripts/install-local.sh, so the path filter skipped Docs checks, it merged green, and main then failed those checks for the next PR that ran them. The roots list was corrected in #1087; this closes the gap that let it through.

checkRepositoryRoots compares git's tracked top-level directories against REPOSITORY_ROOTS and runs from the CLI entry point, so it runs in the Evidence anchors job, which has no path filter and already gates the branch. No extra CI cost. The existing test now calls that function instead of duplicating its logic, and two tests prove it fails closed and names the missing directory.

Verification

• cargo fmt --check, cargo clippy -p registry-evidence-oid4vci --all-targets -- -D warnings: clean.
• cargo test --locked -p registry-evidence-oid4vci: 157 + 1 + 4 + 5 + 15 passed, 0 failed (1 ignored is the pinned stock-issuer container gate).
• Formerly flaky test, focused reruns: 30/30 locally, plus 200/200 under CPU contention and 40/40 for the whole suite under load during development.
• products/evidence/scripts/check-source-neutrality.sh: passed.
• docs/site: npm test 601/601, npm run check clean, and node docs/site/scripts/check-evidence-anchors.mjs passes on the real tree.
• Gate proof: with a temporary tracked top-level directory present, the checker exits 1 naming it; removed, it exits 0.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.