The security-floor route sweep is timed: it fails when it takes more than 5 s #10401

One sentence: the last box of #10386 — the sweep that keeps the security floor must stay cheap enough to run on every push.

Done:

• [x] test/security-floor-routes.test.ts (and test/security-sweep.test.ts if it walks the routes too) measures its own request loop and expects it under 5 s; the assertion fails when a delay is injected locally.
• [x] If it is over today, the cost is cut by sharing one seeded server and issuing requests with bounded concurrency, not by dropping routes; the UNSEEDED list stays checked both ways.
• [x] The measured time is named in the pull.

Files: test/security-floor-routes.test.ts, test/security-sweep.test.ts Risks: a wall-clock bound flakes on a loaded runner; assert on the loop only, with the 5 s ceiling, never on server boot. Crew: a Sonnet builder with the test/gate brief.

Reviewed pull #10416 at its head: ticked test/security-floor-routes.test.ts (and test/security-sweep.test.ts if it walks the routes too) measures its own request loop and expects it under 5 s; the assertion fails when a delay is injected locally.; If it is over today, the cost is cut by sharing one seeded server and issuing requests with bounded concurrency, not by dropping routes; the UNSEEDED list stays checked both ways.; The measured time is named in the pull..