fix(framework): fail closed on drift blind spots (#1194)

packages/mosaic/framework/tools/_scripts/mosaic-doctor

@@ -160,11 +160,26 @@ echo "[mosaic-doctor] Mosaic home: $MOSAIC_HOME"
 framework_drift_checker="$(cd -- "$(dirname -- "$0")/../quality/scripts" && pwd)/framework-drift-check.py"
 if [[ -f "$framework_drift_checker" ]]; then
   echo "[mosaic-doctor] Checking installed framework-tool drift..."
-  if python3 "$framework_drift_checker" --installed-root "$MOSAIC_HOME/tools"; then
-    pass "Installed framework tools match shipped source"
-  else
+  drift_timeout="${MOSAIC_DOCTOR_DRIFT_TIMEOUT_SEC:-15}"
+  if ! [[ "$drift_timeout" =~ ^[1-9][0-9]*$ ]]; then
+    warn "Invalid MOSAIC_DOCTOR_DRIFT_TIMEOUT_SEC='$drift_timeout' (expected positive integer); using 15s"
+    drift_timeout=15
+  fi
+  if command -v timeout >/dev/null 2>&1; then
+    set +e
+    timeout --signal=TERM --kill-after=2 "${drift_timeout}s" \
+      python3 "$framework_drift_checker" --installed-root "$MOSAIC_HOME/tools"
     drift_rc=$?
-    warn "Installed framework-tool drift detected (checker exit $drift_rc; no files changed)"
+    set -e
+    if [[ "$drift_rc" -eq 0 ]]; then
+      pass "Installed framework tools match shipped source"
+    elif [[ "$drift_rc" -eq 124 || "$drift_rc" -eq 137 ]]; then
+      warn "CANNOT_ASSERT framework drift checker timed out after ${drift_timeout}s; continuing remaining doctor checks"
+    else
+      warn "Installed framework-tool drift detected (checker exit $drift_rc; no files changed)"
+    fi
+  else
+    warn "CANNOT_ASSERT timeout utility unavailable; refusing unbounded framework drift check and continuing remaining doctor checks"
   fi
 else
   warn "Framework drift checker is absent from the shipped tools tree"