fix(revocation): validate bundle freshness policy inputs

[altrudev]

Closes #286.

What

The public revocation-bundle consumer used now, max_bundle_age_seconds, and max_future_skew_seconds directly in freshness arithmetic without holding them to the documented integer-seconds boundary.

In Python, booleans are integer subclasses, so True/False were acted on as 1/0 seconds. Because sign.verify_record() delegates bundle freshness to check_bundle(), the same boundary also affects its bundle-specific max_bundle_age_seconds when a bundle is actually checked.

This change adds one local _check_seconds() boundary in revocation.py and applies it before bundle shape or freshness evaluation.

Ownership boundary

PR #239 already owns top-level Trust Record freshness validation for sign.verify_record(max_age_seconds=...) and sign.verify_record(max_future_skew_seconds=...). This PR does not modify that lane.

Regression coverage

The focused tests refuse True and False for:

• revocation.check_bundle(now=...);
• revocation.check_bundle(max_bundle_age_seconds=...);
• revocation.check_bundle(max_future_skew_seconds=...);
• sign.verify_record(max_bundle_age_seconds=...) when a revocation bundle is checked.

Integer controls show the calls proceed to the existing bundle-shape outcome instead of being rejected by the new boundary.

No floating-point/double cases are part of this claim.

Scope

No change to defaults, bundle schema, freshness arithmetic, signature verification, or the three revocation outcome states.

AI-assistance disclosure: ChatGPT assisted with source triage, adversarial-case design, duplicate/ownership review, implementation drafting, and diff review. altrudev reviewed the bounded claim and remains responsible for the contribution.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[lywinged]

Approved on 8de5b5b over fc38496. Reproduced on main: check_bundle() with max_bundle_age_seconds=True and max_future_skew_seconds=False runs through to an outcome. On this head each of the three seconds inputs refuses True and False with a ValueError naming the argument, and integers proceed to the bundle-shape outcome as before; the PR's own test file has 8 of 10 cases failing against main and none here. sign.verify_record() already refuses a boolean now, and max_age_seconds stays with #239 as the body says. Suite 1,177 passed, 1 skipped; ruff, mypy and the dash check clean.

Tool-assisted: the runs and this write-up.