fix(security): harden Python service boundaries

tests/test_calendar_reminder_minutes_parsing.py

@@ -123,3 +123,37 @@ async def test_update_event_can_add_reminder_after_creation():
         assert note is not None, "update_event should create the reminder note"
     finally:
         db.close()
+
+
+async def test_reminder_and_duration_parsers_stay_linear_on_digit_and_space_floods():
+    """CodeQL py/polynomial-redos: `(\\d+)\\s*unit` rescanned a digit run from
+    every offset and `alarm\\s*:?\\s*\\d+` split one whitespace run two ways.
+    Tool arguments come from model output, so keep them O(n)."""
+    import time
+    from src.tool_implementations import do_manage_calendar
+
+    owner = "tester-" + uuid.uuid4().hex[:6]
+    started = time.perf_counter()
+    res = await do_manage_calendar(json.dumps({
+        "action": "create_event",
+        "summary": "Flood",
+        "dtstart": "2030-04-01T10:00:00",
+        "reminder_minutes": "0" * 40_000 + "x",
+        "duration": "0" * 40_000 + "x",
+    }), owner=owner)
+    assert time.perf_counter() - started < 2.0
+    assert res.get("exit_code") == 0, res
+    assert "reminder set" not in res.get("response", ""), res
+
+    # A reminder is set, so the "is the description only a reminder?" check runs.
+    started = time.perf_counter()
+    res = await do_manage_calendar(json.dumps({
+        "action": "create_event",
+        "summary": "Flood 2",
+        "dtstart": "2030-04-02T10:00:00",
+        "description": "alarm" + "\t" * 40_000,
+        "reminder_minutes": 5,
+    }), owner=owner)
+    assert time.perf_counter() - started < 2.0
+    assert res.get("exit_code") == 0, res
+    assert "reminder 5 min before" in res.get("response", ""), res