refactor: consolidate coercion contracts (#122458)

* refactor: consolidate coercion contracts

Centralize exact string, record, numeric, date, Boolean, argument, and structured-error coercions while preserving call-site semantics.

Migrate canonical-name collisions and deprecated internal SDK bypasses, deleting 55 net production/tooling lines. Expand declaration ownership enforcement to 101 allowed helpers and add a narrow export-completeness audit.

* fix: preserve standalone script coercions

Keep copied Control UI tooling self-contained and retain the trusted release harness module-relative source seam when the harness runs against an old target cwd.

scripts/pre-commit/pnpm-audit-prod.mjs

@@ -708,7 +708,7 @@ function parsePositiveIntegerEnv(name, fallback) {
 }
 
 function resolveBulkAdvisoryRequestTimeoutMs() {
-  return clampTimerTimeoutMs(
+  return clampBulkAdvisoryTimeoutMs(
     parsePositiveIntegerEnv(
       "OPENCLAW_PNPM_AUDIT_BULK_TIMEOUT_MS",
       BULK_ADVISORY_REQUEST_TIMEOUT_MS,
@@ -723,13 +723,13 @@ function resolveBulkAdvisoryResponseBodyMaxBytes() {
   );
 }
 
-function clampTimerTimeoutMs(valueMs) {
+function clampBulkAdvisoryTimeoutMs(valueMs) {
   const value = Number.isFinite(valueMs) ? valueMs : BULK_ADVISORY_REQUEST_TIMEOUT_MS;
   return Math.min(Math.max(Math.floor(value), 1), MAX_TIMER_TIMEOUT_MS);
 }
 
 async function withBulkAdvisoryTimeout({ label, timeoutMs, run }) {
-  const resolvedTimeoutMs = clampTimerTimeoutMs(timeoutMs);
+  const resolvedTimeoutMs = clampBulkAdvisoryTimeoutMs(timeoutMs);
   const controller = new AbortController();
   let timeout;
   const timeoutPromise = new Promise((_resolve, reject) => {