Fix test failures: HMAC length check (P3), fast-check fround (P5)

- P3: timingSafeEqual requires equal-length buffers; add length guard before compare
- P5: fast-check fc.float requires 32-bit floats; wrap min with Math.fround()
- All 5 Node products: 83 tests passing across 13 test files

products/03-alert-intelligence/src/ingestion/webhook.ts

@@ -53,7 +53,8 @@ export function validateDatadogHmac(
     .update(timestamp + body)
     .digest('hex');
 
-  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+  const sigBuf = Buffer.from(signature), expBuf = Buffer.from(expected);
+  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
     return { valid: false, error: 'Invalid signature' };
   }
 
@@ -90,7 +91,8 @@ export function validatePagerdutyHmac(
     .digest('hex');
 
   const sig = sigPart.slice(3);
-  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
+  const sigBuf2 = Buffer.from(sig), expBuf2 = Buffer.from(expected);
+  if (sigBuf2.length !== expBuf2.length || !crypto.timingSafeEqual(sigBuf2, expBuf2)) {
     return { valid: false, error: 'Invalid signature' };
   }
 
@@ -128,7 +130,8 @@ export function validateOpsgenieHmac(
     .update(body)
     .digest('hex');
 
-  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+  const sigBuf = Buffer.from(signature), expBuf = Buffer.from(expected);
+  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
     return { valid: false, error: 'Invalid signature' };
   }