build: harden controller v2 runtime

tests/test_config_contracts.py

@@ -115,6 +115,30 @@ class ConfigurationTests(unittest.TestCase):
             with self.assertRaisesRegex(ConfigError, "attempt, continue, or reject"):
                 load_config(path, environ={})
 
+    def test_non_finite_timeouts_are_rejected(self):
+        for value in (".nan", ".inf", "-.inf"):
+            with self.subTest(value=value), tempfile.TemporaryDirectory() as directory:
+                path = Path(directory) / "config.yaml"
+                path.write_text(
+                    f"router:\n  confirmation_timeout_seconds: {value}\n",
+                    encoding="utf-8",
+                )
+                with self.assertRaisesRegex(ConfigError, "must be finite"):
+                    load_config(path, environ={})
+
+    def test_runtime_paths_must_be_absolute(self):
+        cases = (
+            ("storage:\n  media_base: relative/media\n", "storage.media_base"),
+            ("storage:\n  data_base: relative/data\n", "storage.data_base"),
+            ("downloads:\n  cookie_path: relative/cookies.txt\n", "downloads.cookie_path"),
+        )
+        for contents, field in cases:
+            with self.subTest(field=field), tempfile.TemporaryDirectory() as directory:
+                path = Path(directory) / "config.yaml"
+                path.write_text(contents, encoding="utf-8")
+                with self.assertRaisesRegex(ConfigError, f"{field} must be an absolute path"):
+                    load_config(path, environ={})
+
 
 class ImportLifecycleTests(unittest.TestCase):
     def test_controller_core_import_does_not_connect_or_create_runtime_paths(self):