🛡️ Sentinel: Fix Numerical Instability in Favoritism Module

[fderuiter]

🛡️ Sentinel: [CRITICAL/HIGH] Fix Numerical Instability in Favoritism Module

Vulnerability:
The calculate_favoritism_score function previously accepted unbounded and invalid floating-point inputs (NaN, Infinity, negative time).

• NaN inputs in time.t were silently coerced to 0.0 due to max(0.0), leading to a score of 0.0 (Silent Failure).
• NaN inputs in other fields (e.g., personality) propagated NaN through the system.
• Unbounded inputs could theoretically cause integration issues or DoS.

Fix:

• Implemented strict input validation in FavoritismInputs::validate().
• Introduced try_calculate_favoritism_score which returns Result<f64, FavoritismError>.
• Updated the legacy calculate_favoritism_score to use the safe version and strictly return NaN if inputs are invalid, preventing misleading 0.0 results.
• Updated find_favorite_child to treat invalid inputs as -Infinity (lowest possible score) rather than NaN (which breaks sorting/comparison), ensuring robust behavior.

Verification:

• Added tests/test_favoritism_security.rs verifying that invalid inputs return Err (safe version) or NaN (legacy version).
• Verified existing tests in tests/test_favoritism.rs still pass.

---

PR created automatically by Jules for task 7740966389182008347 started by @fderuiter

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.