Repair master CI regressions for private task stack

Preserve existing PR history and verified downstream privacy rules.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/src/live/runnerd-codex-transport.test.ts

@@ -7571,14 +7571,6 @@ it("preserves prepared input and completion feedback through runnerd and the rea
   `], { maxBuffer: 16 * 1024 * 1024 });
   await writeFile(proxy, proxyBytes, { mode: 0o755 });
   const digest = (file: string) => `sha256:${createHash("sha256").update(readFileSync(file)).digest("hex")}`;
-  // Linux runner images can install Node with group-write permission. Qualify
-  // an isolated copy without mutating the host. Keep the original on macOS,
-  // where Homebrew Node can load dylibs relative to its installation directory.
-  const providerNode = process.platform === "linux" ? join(root, "node") : process.execPath;
-  if (providerNode !== process.execPath) {
-    await cp(process.execPath, providerNode);
-    await chmod(providerNode, 0o755);
-  }
   const runtime = join(root, "opencode");
   const bundle = createCapabilityRunnerdCodexTransport({
     provider: "opencode",

server/src/__tests__/tool-gateway-connector-telemetry.test.ts

@@ -265,6 +265,7 @@ describeEmbeddedPostgres("gateway connector invocation telemetry", () => {
   }, 30_000);
 
   afterEach(async () => {
+    vi.useRealTimers();
     track.mockClear();
     failLogActivityForAction.current = null;
     await db.delete(activityLog);
@@ -379,6 +380,9 @@ describeEmbeddedPostgres("gateway connector invocation telemetry", () => {
   }, 30_000);
 
   it("emits one denied event for a policy block and one rate_limited event past the limit", async () => {
+    // Both calls must land in the same policy window, even across a minute boundary.
+    vi.useFakeTimers({ toFake: ["Date"] });
+    vi.setSystemTime(new Date("2026-10-06T12:00:30Z"));
     const f = await fixture();
     await db.insert(toolPolicies).values({
       companyId: f.company.id,

ui/src/features/connections/ConnectionIntentInteractionBody.test.tsx

@@ -508,7 +508,8 @@ describe("AI repair inside the card", () => {
     setupOptionsMock.mockResolvedValue({ interaction, existingConnections: [], aiConnection: binding, aiConnectionRequiresAdoption: true });
     if (fails) adoptMock.mockRejectedValue(new Error("Connection test failed"));
     else adoptMock.mockResolvedValue({ ...interaction, status: "accepted" });
-    renderBody(interaction); await flush();
+    renderBody(interaction);
+    await waitForAssertion(() => expect(button("Connect OpenAI")).toBeDefined());
     await act(() => button("Connect OpenAI")!.click());
     await act(() => button("Reconnect selected account")!.click());
     expect(adoptMock).not.toHaveBeenCalled();