[pending-judge] fix(r5): exercise the boot-timeout kill, total bridge-body handling, strict subdomain labels (judge r4 blockers)

- __tests__/e2e-node/composition-root.e2e.test.js: `boot()` takes {timeoutMs, code}
  and the timeout rejection carries the child it killed; a NEW test drives the real
  timeout against a child that never reports PORT/READY and asserts the OS-observed
  SIGKILL on that child (marker e2e-timeout-kill) — the r4 claim is now exercised.
- routes/deploys.js: bridge() coerces any non-object JSON body (null/[]/string) into
  the same failure shape as a non-JSON body, so no `body.ok` deref can 500 or report a
  false success; the subdomain label regex rejects leading AND trailing hyphens.
- __tests__/routes/deploys.catalog.r4.test.js: trailing-dash rejection case + three
  malformed-successful-body cases (clean 502, never 500).

dashcaddy-api/__tests__/routes/deploys.catalog.r4.test.js

@@ -82,6 +82,7 @@ describe('DC-CATALOG-3 r4: audit contract + subdomain forwarding', () => {
     ['uppercase', 'MyBot'],
     ['underscore', 'my_bot'],
     ['leading dash', '-bot'],
+    ['trailing dash', 'bot-'],
     ['too long', 'a'.repeat(64)],
   ])('invalid subdomain %s rejected with 400 before the bridge', async (_l, sub) => {
     const { app, calls } = makeApp({});
@@ -91,4 +92,20 @@ describe('DC-CATALOG-3 r4: audit contract + subdomain forwarding', () => {
       .expect(400);
     expect(calls).toHaveLength(0);
   });
+
+  // judge r4 polish: a 200 whose JSON body is not a plain object (res.json()
+  // resolves for `null`, `[]`, `0`, `"x"`) must not reach `body.ok` as a
+  // null-deref (500) or as a truthy string (false success) — it is a clean 502.
+  it.each([
+    ['null body', null],
+    ['string body', 'ok'],
+    ['array body', []],
+  ])('malformed successful bridge response (%s) is a clean 502, never a 500', async (_l, malformed) => {
+    const { app } = makeApp({ 'POST /api/catalog/deploy': { status: 200, body: malformed } });
+    const res = await request(app)
+      .post('/api/v1/deploys/catalog/deploy')
+      .send({ app: 'whoami', port: 8100 })
+      .expect(502);
+    expect(String(res.body.error)).toContain('malformed');
+  });
 });