test(seo): bound language metadata navigation checks

[sbc1-code]

PR129's production run timed out before upload: run 38284994002 was cancelled and deployment was skipped. One viewport passed the hreflang fixture, while the other stopped after the preceding FAQ fixture. The new predicate waits were unbounded.

Metadata URL/predicate waits now fail after 10 seconds, and the combined fixture has a 60-second deadline with route diagnostics. Crossing language switching verifies rendered Spanish copy and the selected Spanish control before asserting the exact canonical and hreflang set. This avoids coupling the alternate test to a separately confirmed, pre-existing document-language cleanup race after crossing data/aggregate updates. That issue remains separate; every canonical/alternate assertion and provider block stays intact.

Validation: complete npm test passed against a VITE_PUBLIC_CBP_API=true build, including 213 generated-page metadata checks and 402 desktop/mobile navigations with providers blocked/mocked. Focused production-setting checks passed too. Independent read-only review approved the final three-file diff with no blocking findings and independently reran syntax/diff checks and all four hreflang unit tests.

This is a test-only recovery for PR129. No application, data, sitemap, dependency, credential, ads or analytics changes. CI must pass before merge; production publication and exact manifest/assets/live metadata verification remain pending.

[sbc1-code]

Independent review gate approved the final three-file recovery diff with no blocking findings. Reviewer confirmed correctly placed 10-second URL/predicate bounds, the cleared 60-second fixture deadline, both rendered page-level language and selected control checks, and unchanged exact canonical/hreflang assertions. Syntax checks, git diff --check and all four hreflang unit tests independently passed.

Implementer additionally passed the full npm test suite against the production-setting build (213 static pages; 402 desktop/mobile navigations; external providers blocked/mocked). Original run 38284994002 is terminal CANCELLED with deployment SKIPPED. Current main advanced only collector/anomaly data since fdbb877; PR128 and PR129 remain preserved. Exact-head CI and actual production readback remain release gates.

[sbc1-code]

Final recovery publication succeeded: https://github.com/sbc1-code/borderpulse/actions/runs/38287800593 . Vercel deployment dpl_FN9QPJxUFXDfU9f1UeuE45uBmmxX is READY and aliased to borderpulse.com/www.borderpulse.com; Vercel commit metadata and public /data/publication.json both identify 2b40cb2.

Final HTTP-only verification passed for all 171 sitemap pages, including home, crossing, best-time, comparison, blog EN/ES and language pairs: exact canonicals, route-appropriate hreflangs, 36 blog pages/18 reciprocal pairs, and methodology/privacy twins. All 24 served JavaScript/CSS assets matched the reproduced production-setting build by SHA-256. No provider scripts executed. PR128 and PR129 are ancestors of the served commit; report-time data behavior is preserved.

The original run 38284994002 was cancelled by GitHub's 20-minute job timeout, not manually cancelled by the implementer; deployment was skipped. The independently reviewed test-only recovery keeps all metadata assertions while bounding waits and avoiding the pre-existing document-language cleanup race. Full local release tests and both PR130 CI runs passed before merge. This automatic publication was already active before the request to avoid another deployment; none was initiated afterward. No remaining release blocker. Dynamic sitemap inventory and document-language cleanup remain separate.