Fix five review follow-ups

[richardmhope]

Closes #166
Closes #167
Closes #169
Closes #171
Closes #174

All five real. Grouped because they are one review round's findings across three
just-merged pull requests, and the repository already does this (a0e8a88) —
splitting them would be five review cycles for changes averaging four lines.

A rule could be pointed at a disbanded team (#166)

Routing already skips such a rule, so accepting it let an admin build a rule that
holds a place in the evaluation order and silently matches nothing. Now a 422 at
the moment it is written, on create and on PATCH.

source_tags: null did not widen a rule (#167)

Every other matcher is read off model_fields_set — null drops the restriction,
an omitted field leaves it alone. This one ignored an explicit null, which left an
operator unable to widen a rule through the documented contract, with a stale tag
quietly preventing the routing it was written for.

The ownership screen's team links were ignored (#171)

They pointed at ?owner_group_id=, which is the API's parameter; the web route
reads ?owner= and translates. An administrator clicking a team's backlog was
shown every team's findings.

The existing test could not see this because it composed its own URL. The new one
follows the href the screen actually renders — which is the only version of this
test worth having.

The directory cap did not bound memory (#174)

sorted(os.scandir(...)) materialised the whole listing and the cap fired
afterwards, so a directory large enough to matter killed the worker instead of
producing the bounded scope gap it promises. Entries are now read through islice
— the cap plus one, to notice there were more — and sorted after.

The comment now also states what the cap costs: which entries survive is filesystem
order, which is exactly why it is a scope gap rather than a count that stopped
early.

The schedule test could pass while broken (#169)

My own fix for the wall-clock flake was too weak. For the fifteen minutes before
03:00 the unchanged 03:00 satisfies both "on a quarter-hour" and "within
fifteen minutes", so a broken recompute would have passed.

The original cron is now 7 3 * * * — minute seven, which no */15 boundary can
ever equal — plus an explicit inequality against the value it replaced. Verified by
stubbing out the recompute and watching the test fail.

Verification

Every fix has a test that fails without it; each was checked by stashing the source
change and re-running. The five that must fail, did:

FAILED test_a_rule_cannot_be_pointed_at_a_disbanded_team
FAILED test_an_existing_rule_cannot_be_moved_to_a_disbanded_team
FAILED test_sending_null_tags_widens_the_rule
FAILED test_a_teams_queue_link_from_the_ownership_screen_really_filters
FAILED test_an_oversized_directory_is_capped_before_it_is_materialised  (read 20 entries with the cap at 2)

One existing test needed reordering rather than fixing: test_ownership_policy_changes_are_audited
disbanded a group before creating a rule for it, which #166 now refuses — so it had
been asserting the audit trail of operations that would no longer happen.

make check green: 1813 passed.

[icebergai-review-bot]

Verdict

APPROVE

Completed bounded review across 1 immutable scope(s). No actionable findings in the supplied change.

Scope health

Convergence: healthy. Review mode: initial.
Recommended action: CONTINUE_INCREMENTAL.

• No escalation signals.

Prior findings

Finding	Status
—	No prior finding state

New findings

No new findings.

Fix-induced regressions

• None evidenced.

Uncertainty

• No material uncertainty recorded.

Validation

• Reviewed all supplied source and test diffs. Exact-head CI was reported as passed.

Residual risks

• None identified.