[pending-judge] fix(r5): exercise the boot-timeout kill, total bridge-body handling, strict subdomain labels (judge r4 blockers)

- __tests__/e2e-node/composition-root.e2e.test.js: `boot()` takes {timeoutMs, code}
  and the timeout rejection carries the child it killed; a NEW test drives the real
  timeout against a child that never reports PORT/READY and asserts the OS-observed
  SIGKILL on that child (marker e2e-timeout-kill) — the r4 claim is now exercised.
- routes/deploys.js: bridge() coerces any non-object JSON body (null/[]/string) into
  the same failure shape as a non-JSON body, so no `body.ok` deref can 500 or report a
  false success; the subdomain label regex rejects leading AND trailing hyphens.
- __tests__/routes/deploys.catalog.r4.test.js: trailing-dash rejection case + three
  malformed-successful-body cases (clean 502, never 500).

dashcaddy-api/routes/deploys.js

@@ -76,6 +76,15 @@ module.exports = function ({ asyncHandler, log, auditLogger, fetchT }) {
     } catch (e) {
       parsed = { ok: false, error: 'bridge returned non-JSON response' };
     }
+    // POLISH (judge r4): res.json() also resolves for the JSON literals `null`,
+    // `[]`, `0`, `"x"`. A successful-but-empty/malformed bridge response must
+    // not reach a `body.ok` dereference as null (TypeError -> 500) or as a
+    // truthy string (silent false success). Coerce anything that is not a
+    // plain object into the same failure shape as the non-JSON branch, so
+    // every `body.ok` below is total for any bridge output.
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      parsed = { ok: false, error: 'bridge returned a malformed response body' };
+    }
     return { status: res.status, body: parsed };
   }
 
@@ -119,7 +128,10 @@ module.exports = function ({ asyncHandler, log, auditLogger, fetchT }) {
       env[k] = v;
     }
     const subdomain = String((req.body && req.body.subdomain) || '');
-    if (subdomain !== '' && !/^[a-z0-9][a-z0-9-]{0,62}$/.test(subdomain)) {
+    // POLISH (judge r4): DNS labels may not begin or end with a hyphen, so
+    // `-bot` and `bot-` are both rejected (the previous pattern allowed the
+    // trailing form); 1-63 chars, lowercase alphanumerics and inner hyphens.
+    if (subdomain !== '' && !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(subdomain)) {
       return errorResponse(res, 400, 'invalid subdomain');
     }
     const payload = {