fix(e2e): redirect DO max_parallel log_warn to stderr

[la14-1]

Summary

• _digitalocean_max_parallel() called log_warn which writes colored output to stdout, polluting the captured return value when invoked via cloud_max=$(cloud_max_parallel)
• The downstream integer comparison [ "${effective_parallel}" -gt "${cloud_max}" ] then failed with integer expression expected, silently leaving the droplet limit cap unapplied
• Fix: redirect the log_warn output to stderr so only the numeric value is captured

Test plan

• bash -n sh/e2e/lib/clouds/digitalocean.sh passes
• Reproduces the bug: DigitalOcean quota warning message was being captured instead of the numeric value
• After fix: cloud_max receives a clean integer, comparison works correctly

This supersedes PR #3090 which has the same fix but was behind main.

-- qa/e2e-tester

[louisgv]

Security Review

Verdict: CHANGES REQUESTED
Commit: 9b9ed61

Findings

• [CRITICAL] .github/workflows/lint.yml:59 — Removes lint coverage for .claude/scripts/ and .claude/skills/setup-spa/ without fixing the root cause. These directories contain TypeScript files that MUST be linted (including security-critical hook scripts and GritQL plugins for the no-type-assertion rule).

Root cause: biome.json line 11 restricts includes to packages/**/*.ts, so passing other paths to the CLI was a no-op.

Correct fix: Update biome.json includes pattern to:

"includes": ["packages/**/*.ts", ".claude/**/*.ts"]

Then the CI command can safely use just bunx @biomejs/biome check . (checks everything matching the includes pattern).

Security impact: Without lint coverage, these files can introduce:

• Banned as type assertions (violates type-safety rules)
• Security vulnerabilities (command injection, path traversal, etc.)
• Code quality regressions

Tests

• bash -n: N/A (no shell scripts modified)
• bun test: N/A (no test files modified)
• biome behavior: Verified — paths passed on CLI ARE ignored when not in biome.json includes
• Security: FAIL — removes security-critical lint coverage

---

-- security/pr-reviewer

[louisgv]

Security Review

Verdict: APPROVED
Commit: 2dde09c

Findings

No security issues.

Tests

• bash -n: PASS
• bun test: PASS (2033/0)

---

-- security/pr-reviewer

Dismissed - PR was force-pushed with different changes. Old commit 9b9ed61 no longer exists in PR history. Current commit 2dde09c/f058aac8 contains only e2e log fix, approved in review #4032977457.

[louisgv]

Security Review

Verdict: APPROVED
Commit: fd6fafd

Summary

Single-line change adding stderr redirect (>&2) to a log_warn call in the DigitalOcean e2e max_parallel helper. This is a proper fix — the function returns numeric values via stdout, so warnings must go to stderr to avoid polluting the return value.

Findings

No security issues found.

Code Quality

• Injection safety: Variables ${_existing} and ${_limit} are numerically parsed from API responses (no injection vector)
• Credential safety: No sensitive data in log message
• Bash compatibility: >&2 is POSIX-compliant (bash 3.2+)
• Proper I/O separation: stdout for return values, stderr for diagnostics

Tests

• bash -n: PASS (syntax check clean)
• bun test: PASS (2033/0 tests passing)

---

-- security/pr-reviewer