#2864 fix(cloud-tests): cubic follow-ups from production deploy review

Summary

Cubic flagged 5 issues on PR #2862 (the auto-generated main → release production deploy PR). 4 were real and are fixed here; 1 was a false positive (jest hoisting with ts-jest).

Real bugs fixed

Severity	File	Bug
P1	CloudTestsSection.tsx	"Fix All" could include passing findings in the batch target. Service groups merge failed+passed, and canFixFinding doesn't gate on status — so a passing check could be queued for remediation. Now filtered explicitly.
P2	exception-expiry.utils.ts	ISO 8601 regex made the timezone offset optional; timestamps without Z/+00:00 got parsed in server-local time, giving inconsistent expiries on UTC vs Pacific hosts. Offset now required.
P2	reconciliation.service.ts	Dead !prior.passed === false line — identical to the next if (prior.passed) continue. Removed for clarity.
P2	ai-description.prompt.ts	\bA\.\d+\.\d+(\.\d+)?\b/ lacked /i, so lowercase ISO 27001 control citations (a.5.1.2) slipped past the forbidden-content guard. Added /i and a regression test.

False positive skipped

• P1 Jest hoisting in exception.service.spec.ts / reconciliation.service.spec.ts: that rule is enforced by babel-plugin-jest-hoist (default in babel-jest). This project uses ts-jest, which doesn't enforce the strict mock* naming convention. CI is green and all 145 tests pass. Renaming would be cosmetic insurance against a future babel-jest migration; not blocking.

Test plan

• npx jest src/cloud-security/exception-expiry src/cloud-security/ai-description src/cloud-security/reconciliation — 32 tests pass
• npx tsc --noEmit on both apps/api and apps/app — clean for changed files
• Visual: open a service group with only passing findings, confirm "Fix All" button doesn't appear (the existing group.failed > 1 guard already gates the button, so this fix is belt-and-suspenders for any future code path that opens the batch dialog directly)
• Visual: try to mark an exception with expiresAt = "2026-08-13T23:59:59" (no TZ) and confirm the API rejects with a clear message

🤖 Generated with Claude Code

---

Summary by cubic

Fixes four issues flagged by Cubic in the production deploy review to prevent incorrect batch remediation and ensure consistent validation. One Jest hoisting warning was a false positive and skipped.

• Bug Fixes
  • Cloud tests: “Fix All” now only targets failing findings before applying canFixFinding.
  • Exception expiry: ISO 8601 timestamps now require an explicit timezone offset; timezone-less inputs are rejected.
  • Reconciliation: Removed redundant !prior.passed === false check for clarity; behavior unchanged.
  • AI description: ISO 27001 control regex is now case-insensitive to block lowercase citations (e.g., a.5.1.2).