- Guard against non-object JSON.parse results (primitives, arrays,
  null) before casting to Record in loadViewState migration path
- Add LOCKED_REPOS_CAP (50) and .max(200) string constraint for
  defense-in-depth consistency with ignoredItems/trackedItems caps

- Slice migrateLockedRepos result to LOCKED_REPOS_CAP (50) to prevent
  merged per-tab arrays exceeding Zod .max(50) and wiping view state
- Guard lockRepo push with length < LOCKED_REPOS_CAP to prevent
  runtime accumulation beyond schema limit

An oversized lockedRepos array (>50 entries) that bypasses migration
(already in array format) would fail .max(LOCKED_REPOS_CAP) and cause
safeParse to reject the entire ViewState, wiping all user settings.
Truncate before validation to prevent total state loss.

- Test migrateLockedRepos with actions as preferred tab (full ordering)
- Test >50 merged entries capped at LOCKED_REPOS_CAP (regression guard
  for data-loss bug where oversized array fails Zod .max())
- Test lockRepo silently no-ops at cap boundary

- API smoke tests now include Origin header (WAF correctly blocks
  /api/* without Origin for CSRF protection)
- Adds explicit test that bare /api/health is blocked (403)
- Reduces parallel jobs from 10 to 2 with 300ms delay to prevent
  WAF rate-limit timeouts causing flaky false failures