fix(healthcheck): guard negative or zero timeout in check_tcp and check_http

[vaibhavsrv]

Why this matters

In ods/scripts/healthcheck.py, while the CLI entry point validates --timeout > 0, the underlying check functions check_tcp and check_http are reusable programmatic helpers called directly by test suites, background monitors, and custom scripts. When callers pass a non-positive timeout (e.g. 0 or negative values from improper arithmetic or unset configuration), socket.create_connection or urllib.request.urlopen raises unhandled ValueError (timeout must be non-negative) or system-level connection errors instead of returning a controlled boolean status failure.

This change introduces explicit non-positive guards at the top of check_tcp and check_http returning (False, "timeout must be positive"). Existing positive timeout behaviors, retry policies, and CLI contracts remain completely unaffected.

Validation

• Baseline reproduction: Calling check_tcp("127.0.0.1", 80, timeout=0) or check_http(...) with non-positive timeout raised unhandled ValueError: timeout must be non-negative.
• Post-fix verification: Non-positive timeouts cleanly return (False, "timeout must be positive"), and CLI invocation with non-positive values cleanly exits with code 2.
• Telemetry: Healthcheck suites pass: test_healthcheck_timeout_bounds.py passes cleanly (exit code 0). Wired into Linux CI workflow.

Overlap check

• fix(healthcheck): support bracketed IPv6 targets and strip brackets before TCP connect #5875 (merged today): Added bracketed IPv6 support to healthcheck.py. This change touches only timeout bounds validation within check_tcp and check_http without touching address parsing.
• fix(healthcheck): strip whitespace in parse_target and validate host #5950: Added whitespace stripping and host validation to parse_target. This PR operates strictly on timeout validation.
• Does not conflict with or alter any pending network exposure or remote provider contracts.

Risk / AI disclosure

AI-assisted investigation, implementation, and test regressions. This strengthens bounds checking on helper function timeout parameters. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5875 and #5950 at HEAD without conflicts. Production and test diffs passed together; healthcheck IPv6 and redirect policy suites remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.