fix(catalog): keep large builds event-loop responsive

[diegosouzapw]

Summary

Fixes the #9147 catalog-scale event-loop regression without relaxing its 400 ms guard.

The hot path was repeatedly reopening SQLite during token/context enrichment, rebuilding capability snapshots across catalog/finalization/Auto-Combo, scanning the full virtual pool without cooperative yields, and loading unrelated synchronous database diagnostics just to read the cache TTL.

This slice:

• reuses one build-local capability snapshot through fallback, enrichment, finalization, and Auto-Combo preparation
• yields cooperatively while building the catalog and virtual candidate pool
• reads only persisted user settings needed for the TTL
• preserves every one of the 720 seeded models, including the final entry
• leaves the 400 ms regression threshold unchanged

TDD and performance evidence

• RED: 882.0 ms maximum event-loop gap, 503 interleaved ticks
• GREEN on the isolated implementation snapshot: 328.1 ms, 1,039 ticks
• additional isolated GREEN: 237.8 ms
• observed improvement: approximately 62.8%
• critical serial matrix: 39/39 PASS
• all 83 Node importers of changed symbols: PASS
• npm run typecheck:core: PASS
• focused ESLint: PASS
• changelog integrity and diff-check: PASS
• complexity ratchet distribution: 27 → 27, no new debt

Current-host limitation

After rebasing onto the live release/v3.8.50 tip, git range-diff reports the patch as equivalent. A local rerun during host load 66 measured 1,740 ms and failed the unchanged 400 ms bound; it is recorded as INFRA-RED/starvation, not as green. The same environment was concurrently running large Next/TypeScript/Vitest workloads. This PR is intentionally draft so the isolated CI runner can provide the authoritative post-rebase result.

The separate Vitest DB timeout was reproduced on the exact parent and is likewise classified BASE/INFRA-RED; no assertion mismatch was observed.

Release disposition

No workflow, timeout, threshold, baseline, or allowlist was weakened. This PR does not authorize merge, tagging, or publication and must remain open for owner review.

[diegosouzapw]

CI attribution snapshot (2026-08-24)

• Candidate: 6afa6846c8e95c56328c72ede9afb34d7989d4f9
• Exact base: dafb4ae808305c9287c751cf1ce16fe2234ba073
• CodeQL (all four languages), Semgrep, and Semgrep Cloud passed.
• Fast Production Build reached Next.js Creating an optimized production build ... and then GitHub cancelled the operation, with no compiler/type diagnostic. The exact base has the same cancellation signature in run 32693521371.
• dast-smoke was cancelled by SIGTERM while building its CLI prerequisite; it never reached application startup or DAST assertions.
• The focused regression was proven RED at 882.0 ms and GREEN at 328.1 ms with the 400 ms threshold unchanged; 83 direct importer files passed. The later loaded-devbox timing result remains documented as INFRA-RED, not hidden as green.

Therefore no PR-specific build or DAST defect is demonstrated by these two cancelled jobs. The PR remains OPEN and DRAFT; this note does not claim the complete CI matrix is green.