fix(audit): reject malformed rolling artifact tags

Harden phase0 rolling retention timestamp parsing with explicit bounds and UTC round-trip validation; add regression coverage for invalid date/time tags. No architecture/protocol flow changes; diagram files reviewed and no updates were needed.

src/audit/phase0BaselineArtifactRetention.ts

@@ -74,9 +74,28 @@ function parseRollingTagTimestampMs(tag: string): number | undefined {
   if (!Number.isFinite(hour) || !Number.isFinite(minute) || !Number.isFinite(second)) {
     return undefined;
   }
+  if (month < 1 || month > 12 || day < 1 || day > 31 || hour < 0 || hour > 23 || minute < 0 || minute > 59 || second < 0 || second > 59) {
+    return undefined;
+  }
 
   const timestampMs = Date.UTC(year, month - 1, day, hour, minute, second);
-  return Number.isFinite(timestampMs) ? timestampMs : undefined;
+  if (!Number.isFinite(timestampMs)) {
+    return undefined;
+  }
+
+  const utc = new Date(timestampMs);
+  if (
+    utc.getUTCFullYear() !== year
+    || utc.getUTCMonth() !== month - 1
+    || utc.getUTCDate() !== day
+    || utc.getUTCHours() !== hour
+    || utc.getUTCMinutes() !== minute
+    || utc.getUTCSeconds() !== second
+  ) {
+    return undefined;
+  }
+
+  return timestampMs;
 }
 
 function parseRollingArtifactFile(fileName: string): Phase0RollingArtifactFile | undefined {