fix: apply unresolved PR2 review suggestions

[Copilot]

Five unresolved Copilot review comments from PR #2 were never acted on before merge. This addresses all of them, plus follow-up improvements based on subsequent review feedback.

Changes

README.md

• Replace corrupted •• (bad encoding) with 🤖 on line 25

Dockerfile + Kubernetes

• Set USER node before WORKDIR /app in the runner stage so Docker creates /app already owned by the node user — no extra chown layer needed
• Use COPY --chown=node:node for all artifacts in the runner stage; npm ci --omit=dev runs as node
• Add runAsUser: 1000 / runAsGroup: 1000 to the pod-level securityContext in the K8s Deployment to satisfy runAsNonRoot: true

core/wasm/workerPool.ts

• Validate maxQueueSize is a non-negative safe integer; throws on -1, NaN, Infinity, etc.

if (!Number.isSafeInteger(rawMaxQueueSize) || rawMaxQueueSize < 0) {
  throw new Error('WorkerPool: maxQueueSize must be a non-negative safe integer');
}

core/wasm/wasmRunner.ts

• Validate defaultTimeoutMs and maxTimeoutMs are positive finite numbers
• Enforce maxTimeoutMs >= defaultTimeoutMs at construction time

if (!Number.isFinite(defaultTimeoutMs) || defaultTimeoutMs <= 0) {
  throw new Error('WasmRunner: defaultTimeoutMs must be a positive finite number');
}
if (!Number.isFinite(maxTimeoutMs) || maxTimeoutMs <= 0) {
  throw new Error('WasmRunner: maxTimeoutMs must be a positive finite number');
}
if (maxTimeoutMs < defaultTimeoutMs) {
  throw new Error('WasmRunner: maxTimeoutMs must be >= defaultTimeoutMs');
}

tests/workerPool.load.test.ts

• Add unit tests asserting invalid maxQueueSize values (-1, NaN, Infinity, fractional) throw the expected error

tests/wasm.determinism.test.ts

• Add WasmRunner constructor validation suite covering non-positive/non-finite defaultTimeoutMs, non-positive/non-finite maxTimeoutMs, and maxTimeoutMs < defaultTimeoutMs

[Copilot]

Pull request overview

This PR addresses previously unacted Copilot review items by fixing a README encoding artifact, aligning container/Kubernetes non-root execution settings, and adding stricter runtime option validation in the WASM execution utilities.

Changes:

• Fix a corrupted character in the README feature list.
• Run the Docker image as the node user and align Kubernetes securityContext with UID/GID 1000.
• Add input validation for WorkerPool.maxQueueSize and WasmRunner timeout configuration.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Replaces corrupted glyph with the intended emoji in the feature list.
Dockerfile	Ensures runtime is non-root by chowning /app and switching to USER node.
deploy/k8s/base/deployment.yaml	Sets runAsUser/runAsGroup to match the container’s non-root user.
core/wasm/workerPool.ts	Validates maxQueueSize as a non-negative safe integer before assignment.
core/wasm/wasmRunner.ts	Validates timeout options and enforces maxTimeoutMs >= defaultTimeoutMs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SMSDAO]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all three review comments in commit 860f400 (with a follow-up cde4cfa to revert an unintentional package-lock.json change):

1. Dockerfile — removed RUN chown -R node:node /app. All COPY lines in the runner stage now use --chown=node:node, and USER node is set before npm ci --omit=dev so node_modules is also created with the correct ownership.

2. tests/workerPool.load.test.ts — added a test case asserting that -1, NaN, Infinity, and 1.5 all throw 'WorkerPool: maxQueueSize must be a non-negative safe integer'.

3. tests/wasm.determinism.test.ts — added a WasmRunner constructor validation suite covering: non-positive/non-finite defaultTimeoutMs, non-positive/non-finite maxTimeoutMs, and maxTimeoutMs < defaultTimeoutMs.

[Copilot]

@copilot apply changes based on the comments in this thread

Done in commit 7a95ba0. Here's what was applied from the three review comments:

1. Dockerfile — replaced RUN chown -R node:node /app with a zero-overhead approach: USER node is now set before WORKDIR /app, so Docker creates /app already owned by node. All COPY instructions use --chown=node:node and npm ci --omit=dev runs as node. No extra chown layer.

2. workerPool tests — added rejects invalid maxQueueSize configuration covering -1, NaN, Infinity, and fractional values.

3. wasmRunner tests — added WasmRunner constructor validation suite covering non-positive/non-finite defaultTimeoutMs, non-positive/non-finite maxTimeoutMs, and maxTimeoutMs < defaultTimeoutMs.