test(redos): one CPU clock for every bound, and a second row measured dead

`5667063` moved test_output.py's ReDoS bounds off the wall clock, because a
loaded machine steals wall seconds without adding any cycles and two rows
failed at 2.24s / 3.66s against a 2.0s bound while census had the CPU. The
remaining ten bounds in five other files still ran on `time.monotonic()` and
carried the same defect. They now share ONE clock.

The clock is IMPORTED, not copied: `tests/redos_clock.py`. Five private copies
would leave four of them unpinned -- the instrument test
(test_the_redos_clock_ignores_time_this_process_did_not_spend) can only pin the
implementation it calls, and the suite already holds that rule for the code it
measures.

Every ported row was verified the only way a time bound can be: the vulnerable
form patched back in, red demanded, `git checkout --` after. Measured against
the 2.0s bound (3.0s for the url arm):

  active_content long-attr   `{0,63}` -> `*`        RED
  neutralize     long-attr   same patch             RED
  output gate    long-attr   same patch             12.41s
  okf link graph  `[^\]\[]` -> `[^\]]`               6.91s
  sanitize comment  str.find -> `<!--.*?-->`        17.56s
  lexicon md-link-anchor-text                      319.14s
  lexicon md-link-anchor-url                         8.55s
  lexicon md-link-ref-comment                       37.82s

Two rows did not go red, for two different reasons.

test_sanitize.py::test_legitimate_comment_heavy_document is the legitimate SIDE
of a separation, not a second pin on the defect: closed comments never withhold
the required literal, so the lazy form runs it in 0.016s. Recorded in place.

test_lexicon.py::test_redos_pathological_subagent_input_returns_fast is DEAD --
the same zero-signal shape the `<a ` carrier had, found by the same method. The
seed form is `(?:.*?\s+)?` (llm-security 7.8.0, injection-patterns.mjs:84) and
this repo has never carried it: the bounded `{0,12}?` port is in the pattern
table's first commit. Patched in by hand at the row's own size: shipped 0.135s
vs seed 0.113s, separation 1.2x. Not the keyword gate either -- a variant that
reaches the inner branch stays linear over four doublings (exponent ~1.0),
because the nesting is one lazy run inside an OPTIONAL group, never a repeated
one. Left standing with the measurement written into it; picking a new carrier
is an operator call, like the wall-clock row above it.

The dead sibling row named in STATE is fixed: test_active_content.py's
long-attribute row swaps carrier `<a ` -> `<script `, for the reason `5667063`
established on its composed-gate twin -- 0.7.0's own no-URL narrowing put `<a>`
in `_URL_AFFORDANCE_TAGS`, so the tag returns inert BEFORE its body reaches the
arm the row guards. Re-measured here, not inherited: `<a ` 0.041s and NO
findings against the vulnerable form; `<script ` 19.349s against 0.052s
shipped, 373x apart.

`test_pathological_input_returns_within_a_bound` deliberately keeps its wall
clock (operator decision): it claims to catch a hang, and only a wall clock
catches one.

792 tests, 129/129, 6/6.

tests/test_lexicon.py

@@ -9,7 +9,6 @@ Detection is ``text -> findings`` (design principle 3): pure, no I/O, no
 mutation. Disposition (WARN / QUARANTINE / FAIL_SECURE) is the caller's.
 """
 import base64
-import time
 
 import pytest
 
@@ -24,6 +23,7 @@ from llm_ingestion_guard.lexicon import (
     scan_lexicon,
 )
 from llm_ingestion_guard.report import Report, Severity, Source
+from redos_clock import scan_seconds
 
 
 # --- loader ------------------------------------------------------------------
@@ -230,12 +230,34 @@ def test_oversize_input_is_capped_and_flagged():
 def test_redos_pathological_subagent_input_returns_fast():
     # A crafted string that would force catastrophic backtracking on the
     # ORIGINAL nested-`.*?` sub-agent pattern. The bounded port stays linear.
+    #
+    # MEASURED DEAD, and left standing pending an operator decision — the same
+    # zero-signal shape the `<a ` carrier had in test_active_content.py, found by
+    # the same method (patch the vulnerable form back in and demand red). The
+    # seed's actual form is `(?:.*?\s+)?` (llm-security 7.8.0,
+    # scanners/lib/injection-patterns.mjs:84); this repo has never carried it —
+    # the bounded `{0,12}?` port is in the pattern table's FIRST commit (f397cd9),
+    # so there is no in-repo form to revert to. Patched in by hand, at the row's
+    # own 8000-word size:
+    #
+    #     shipped  0.135s   seed form  0.113s     <- separation 1.2x, no signal
+    #
+    # Not a payload-size problem and not the keyword gate either: the payload
+    # never supplies the trailing keyword the outer alternation requires, and a
+    # variant that DOES reach the inner branch (`...that reads ` + the same
+    # padding) stays linear too — 0.026 / 0.029 / 0.060 / 0.129s over four
+    # doublings, exponent ~1.0. The nesting the comment names is one lazy run
+    # inside an OPTIONAL group, never inside a repeated one, so there is no
+    # per-start rescan for the payload to pay for.
+    #
+    # Reviving it needs a payload shape that makes the seed form actually blow
+    # up; two shapes were tried and neither did. Until then this row proves the
+    # scanner runs, not that the port is bounded. Deliberately NOT redesigned
+    # here: choosing a new carrier is the same call the operator reserved for the
+    # `test_pathological_input_returns_within_a_bound` row.
     evil = "spawn an agent that " + ("word " * 8000)
-    start = time.monotonic()
-    r = scan_lexicon(evil)
-    elapsed = time.monotonic() - start
-    assert elapsed < 2.0
-    assert isinstance(r, Report)
+    assert scan_seconds(scan_lexicon, evil) < 2.0
+    assert isinstance(scan_lexicon(evil), Report)
 
 
 # --- crafted ReDoS payloads against the JSON pattern table (OWASP LLM10) -----
@@ -293,6 +315,4 @@ _LEXICON_REDOS_ROWS = [
 )
 def test_crafted_redos_payload_stays_bounded_in_the_lexicon(unit, n, bound):
     payload = (unit * (n // len(unit) + 1))[:n]
-    start = time.monotonic()
-    scan_lexicon(payload)
-    assert time.monotonic() - start < bound
+    assert scan_seconds(scan_lexicon, payload) < bound