fix(oncall): harden DST-safe schedule resolution

[Dushyant-rahangdale]

Summary

Production-hardens OpsKnight on-call scheduling around DST and timezone boundary behavior without a schema migration.

• Rejects nonexistent spring-forward and ambiguous fall-back user-entered local timestamps instead of silently moving coverage to a different instant.
• Preserves the exact stored layer.start instant, including starts intentionally placed in the second occurrence of a fall-back overlap.
• Adds deterministic Temporal-compatible disambiguation for generated recurrence boundaries.
• Enforces monotonic generated boundaries so large political timezone jumps (for example Pacific/Apia skipping an entire civil day) cannot rewind the timeline or emit duplicate/overlapping duty blocks.
• Makes full-duty rotation slots end exactly at the next monotonic rotation boundary, preventing accidental DST gaps/overlaps.
• Preserves wall-clock semantics for daily/multi-day rotations and sub-day intervals that divide 24h (1/2/3/4/6/8/12h).
• Defines arbitrary intervals such as 5h/7h as exact elapsed-duration rotations so they remain contiguous through DST.
• Handles non-1-hour transitions (for example Australia/Lord_Howe) rather than assuming every DST change is 60 minutes.
• Reuses timezone formatters, reduces transition-offset probing, and calculates each next rotation boundary once during expansion to avoid repeated expensive Intl.DateTimeFormat construction.
• Keeps near-window expansion bounded and fail-loud rather than silently truncating large schedules.
• Extends regression coverage for spring-forward, fall-back, second-overlap starts, full-day timezone jumps, hourly rotations, arbitrary rotations, invalid calendar input, and 30-minute DST transitions.
• Documents the scheduling semantics and transition-time validation behavior.

Safety / compatibility

• No database or Prisma migration.
• Existing normal schedule timestamps and common 12h/24h/weekly rotations retain intended wall-clock behavior.
• The stored schedule start is never reinterpreted into a different instant.
• Generated rotation boundaries are monotonic: later nominal positions cannot create coverage before an earlier real boundary.
• Ambiguous/nonexistent form times fail closed rather than guessing.
• Arbitrary non-calendar-aligned rotations keep exact elapsed duration across offset changes.

Validation

Targeted timezone/on-call TypeScript validation and runtime matrices were exercised for:

• America/New_York spring-forward and fall-back
• exact second-occurrence fall-back layer starts
• 1h, 2h, 12h, 24h, weekly, 5h and 7h rotations
• exact coverage-boundary continuity
• fractional offsets
• Australia/Lord_Howe 30-minute DST transitions
• Pacific/Apia full-day political timezone jump, including far-window fast-forwarding and duplicate-interval detection
• invalid/nonexistent/ambiguous local timestamps
• 90-day hourly schedule expansion, including schedules whose start is years before the requested window

Local benchmark for the reported 90-day hourly case dropped from the reported ~1.68s/layer to roughly 75-100ms/layer in the validation runtime after formatter caching and resolver/expansion reductions.

The branch is intentionally kept to one atomic commit for easy review and rollback.

[github-actions]

✅ Passed Vitest Results

Metric	Count
Total Tests	1362
Passed	1362
Failed	0
Skipped	0

• DB smoke test: ✅ Passed

View Full Test Report

[github-actions]

🔒 Security: Results Summary

    4 files  ±0  4 suites  ±0   0s ⏱️ ±0s
   22 tests ±0  1 ✅ ±0  0 💤 ±0     21 ❌ ±0 
1 490 runs   - 1  1 ✅ ±0  0 💤 ±0  1 489 ❌  - 1 

For more details on these failures, see this check.

Results for commit fd5cf77. ± Comparison against base commit 35de953.

♻️ This comment has been updated with latest results.