test(handlers): add coverage for runtime_provision_timeouts.go + classifyScheduleStatus edge cases

Add 20 new tests to admin_schedules_health_test.go:
- classifyScheduleStatus: zero threshold, negative threshold, exactly-at-threshold
  (strict > comparison boundary)
- loadRuntimeProvisionTimeouts: empty dir, non-dir entries, single/multiple
  templates, same-runtime MAX logic, zero/negative/missing runtime, bad YAML,
  missing config — all via t.TempDir() fixtures

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/internal/handlers/admin_schedules_health_test.go

@@ -5,6 +5,9 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
 	"testing"
 	"time"
 
@@ -444,3 +447,178 @@ func TestAdminSchedulesHealth_ResponseFields(t *testing.T) {
 		t.Fatalf("unmet expectations: %v", err)
 	}
 }
+
+// ── classifyScheduleStatus — additional edge cases ─────────────────────────────────
+
+func TestClassifyScheduleStatus_ZeroThreshold(t *testing.T) {
+	now := time.Now()
+	lastRun := now.Add(-365 * 24 * time.Hour) // very old
+	result := classifyScheduleStatus(&lastRun, 0, now)
+	if result != "ok" {
+		t.Errorf("classifyScheduleStatus(threshold=0) = %q; want 'ok'", result)
+	}
+}
+
+func TestClassifyScheduleStatus_NegativeThreshold(t *testing.T) {
+	now := time.Now()
+	lastRun := now.Add(-24 * time.Hour)
+	result := classifyScheduleStatus(&lastRun, -1*time.Hour, now)
+	if result != "ok" {
+		t.Errorf("classifyScheduleStatus(threshold=-1h) = %q; want 'ok'", result)
+	}
+}
+
+func TestClassifyScheduleStatus_ExactlyAtThreshold(t *testing.T) {
+	// Strict >: if now.Sub(lastRun) == threshold, it is NOT stale
+	now := time.Date(2026, 5, 18, 12, 0, 0, 0, time.UTC)
+	lastRun := time.Date(2026, 5, 18, 10, 0, 0, 0, time.UTC) // exactly 2h ago
+	result := classifyScheduleStatus(&lastRun, 2*time.Hour, now)
+	if result != "ok" {
+		t.Errorf("classifyScheduleStatus(exactly at threshold) = %q; want 'ok'", result)
+	}
+}
+
+// ── loadRuntimeProvisionTimeouts (runtime_provision_timeouts.go) ─────────────────
+
+func writeRuntimeConfigYAML(t *testing.T, tmpDir, templateName, runtime string, timeoutSecs int) {
+	t.Helper()
+	dir := filepath.Join(tmpDir, templateName)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		t.Fatalf("MkdirAll(%s): %v", dir, err)
+	}
+	yamlContent := "runtime: " + runtime + "\nruntime_config:\n  provision_timeout_seconds: " + strconv.Itoa(timeoutSecs) + "\n"
+	if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte(yamlContent), 0644); err != nil {
+		t.Fatalf("WriteFile: %v", err)
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_EmptyDir(t *testing.T) {
+	tmpDir := t.TempDir()
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if len(result) != 0 {
+		t.Errorf("loadRuntimeProvisionTimeouts(empty dir) len = %d; want 0", len(result))
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresNonDirEntries(t *testing.T) {
+	tmpDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(tmpDir, "not-a-dir.yaml"), []byte("runtime: hermes\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if len(result) != 0 {
+		t.Errorf("loadRuntimeProvisionTimeouts(file-only dir) len = %d; want 0", len(result))
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_SingleTemplate(t *testing.T) {
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-hermes", "hermes", 300)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if v, ok := result["hermes"]; !ok || v != 300 {
+		t.Errorf("loadRuntimeProvisionTimeouts → hermes = %d; want 300", v)
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_MultipleTemplatesSameRuntime(t *testing.T) {
+	// Two templates using the same runtime — takes the MAX timeout
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-hermes-slow", "hermes", 600)
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-hermes-fast", "hermes", 120)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if v, ok := result["hermes"]; !ok || v != 600 {
+		t.Errorf("loadRuntimeProvisionTimeouts → hermes = %d; want 600 (max of 600, 120)", v)
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_MultipleRuntimes(t *testing.T) {
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-hermes", "hermes", 300)
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-claude-code", "claude-code", 420)
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-deepagents", "deepagents", 180)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	want := map[string]int{
+		"hermes":      300,
+		"claude-code": 420,
+		"deepagents":  180,
+	}
+	for runtime, wantSecs := range want {
+		if got, ok := result[runtime]; !ok || got != wantSecs {
+			t.Errorf("loadRuntimeProvisionTimeouts → %s = %d; want %d", runtime, got, wantSecs)
+		}
+	}
+	if len(result) != len(want) {
+		t.Errorf("loadRuntimeProvisionTimeouts → len = %d; want %d", len(result), len(want))
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresZeroTimeout(t *testing.T) {
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-zero", "zero-runtime", 0)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if _, ok := result["zero-runtime"]; ok {
+		t.Errorf("loadRuntimeProvisionTimeouts → 'zero-runtime' present; want absent (timeout=0)")
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresNegativeTimeout(t *testing.T) {
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-negative", "neg-runtime", -60)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if _, ok := result["neg-runtime"]; ok {
+		t.Errorf("loadRuntimeProvisionTimeouts → 'neg-runtime' present; want absent (timeout<0)")
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresMissingRuntimeField(t *testing.T) {
+	tmpDir := t.TempDir()
+	dir := filepath.Join(tmpDir, "tmpl-no-runtime")
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	yamlContent := "template_name: no-runtime-template\nruntime_config:\n  provision_timeout_seconds: 300\n"
+	if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte(yamlContent), 0644); err != nil {
+		t.Fatal(err)
+	}
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if len(result) != 0 {
+		t.Errorf("loadRuntimeProvisionTimeouts → len = %d; want 0 (runtime field absent)", len(result))
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresMalformedYAML(t *testing.T) {
+	tmpDir := t.TempDir()
+	dir := filepath.Join(tmpDir, "tmpl-bad-yaml")
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	badYAML := "runtime: bad\n  provision_timeout_seconds: not a number\n"
+	if err := os.WriteFile(filepath.Join(dir, "config.yaml"), []byte(badYAML), 0644); err != nil {
+		t.Fatal(err)
+	}
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if len(result) != 0 {
+		t.Errorf("loadRuntimeProvisionTimeouts → len = %d; want 0 (malformed YAML)", len(result))
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresMissingConfig(t *testing.T) {
+	tmpDir := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(tmpDir, "tmpl-no-config"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-good", "good-runtime", 300)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if v, ok := result["good-runtime"]; !ok || v != 300 {
+		t.Errorf("loadRuntimeProvisionTimeouts → good-runtime = %d; want 300", v)
+	}
+}
+
+func TestLoadRuntimeProvisionTimeouts_IgnoresEmptyRuntime(t *testing.T) {
+	tmpDir := t.TempDir()
+	writeRuntimeConfigYAML(t, tmpDir, "tmpl-empty", "", 300)
+	result := loadRuntimeProvisionTimeouts(tmpDir)
+	if len(result) != 0 {
+		t.Errorf("loadRuntimeProvisionTimeouts → len = %d; want 0 (empty runtime)", len(result))
+	}
+}