assertLeaseConstraintsSubset fails open when either expires_at is unparseable (§9.4)

[nficano]

Category: spec-conformance Severity: minor
Location: packages/runtime/src/lease.ts:483-486
Spec: ARCP v1.1 §9.4

What

§9.4 requires the delegated expires_at MUST NOT exceed the parent's. If either value is unparseable the function returns without raising LEASE_SUBSET_VIOLATION. validateLeaseConstraints (called after at job-runner-helpers.ts:266) backstops a malformed child in the delegation path, but this function itself fails open.

Evidence

const c = Date.parse(childExpiry);
const p = Date.parse(parentExpiry);
if (!Number.isFinite(c) || !Number.isFinite(p)) return;
if (c > p) {

Proposed fix

Treat a non-finite parse on either side as a violation (throw LeaseSubsetViolationError) instead of returning.

Acceptance criteria

• A child with expires_at 'garbage' (or a garbage parent) raises LEASE_SUBSET_VIOLATION.