security: require exact request-timeout policy type

[seonghobae]

Buyer-visible request-timeout policy-integrity gap

EgressTimeoutPolicy is retained as an immutable finite request-phase resource policy and later converted immediately before HTTPCore dispatch. Non-exact subclasses are outside that reviewed configuration contract because subclass-controlled conversion behavior could replace the finite ceilings. This is trusted configuration integrity, not a Python-sandbox claim.

Current canonical candidate

The current replacement is Draft PR #220, exact head b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7, stacked on method-policy predecessor #204. Historical #114/#149/#158 remain evidence only; #158 is closed as superseded and none of its checks, reviews, base identity, or mergeability transfer.

Test-first reconstruction on the current policy stack is complete:

• RED-only head a460ca5927c19ae593d70e508e7829dd772252ec failed both new exact-type regressions across Python 3.10–3.14;
• minimal GREEN head 0b72ac4bd946f7a4aa4d6668f701859e03e45cdb introduced the exact built-in policy-type boundary;
• exact final head b0e9b43d4b3c8701e8b6af7a93f1e82a0e9030c7 adds source-grounded migration documentation and its permanent contract;
• exact-head CI passed Python 3.10–3.14, 1,035 tests, 1,762/1,762 production statements, and 590/590 production branches.

Acceptance blockers owned outside this source delta

1. security: reconstruct exact HTTP method strings on protected main #204 must integrate first because both PRs modify src/egressweave/policy.py.
2. The organization dependency-review fail-closed repair is .github#897; its exact current head must pass and integrate before a fresh EgressWeave required scan can be accepted.
3. The organization Strix evidence repair is .github#965; unavailable, incomplete, metadata-less, or mismatched evidence must remain fail-closed.
4. Current-head formal OpenCode and independent Noema approvals are required; wrapper checks and stale reviews are not verdicts.

Acceptance criteria

• Reproduce the non-exact timeout-policy subclass dispatch boundary on the current policy stack.
• Add deterministic hosted RED evidence before production code.
• Preserve exact factory-created policy values, defaults, normalization, constructor parity, deterministic fingerprints, and all existing finite timeout semantics.
• Document the pre-1.0 compatibility narrowing and direct migration to an exact declarative instance.
• Obtain fresh Python 3.10–3.14/package verification with 100% owned-production statement/branch coverage.
• Integrate predecessor security: reconstruct exact HTTP method strings on protected main #204 on an accepted protected tree.
• Reconstruct/retarget security: reject timeout-policy subclasses on the current policy stack #220 onto that exact protected tree without transferring historical evidence.
• Require the actual pinned Dependency Review action and authoritative exact-head Strix evidence.
• Resolve every valid current-head review finding and obtain counted independent formal approvals.
• Revalidate exact head, base, ancestry, rulesets, checks, reviews, and threads immediately before normal protected merge.
• Verify the exact-type boundary from protected main, then close this issue and advance security: reject connection-pool policy subclasses on the current policy stack #221 → security: require exact pool-count scalar types #222.

Non-goals

No raw timeout-object injection API, no weakening or disabling finite timeout values, no Python-sandbox claim, no local substitute for organization-owned security/reviewer evidence, and no manual status or review synthesis.