fix: address Copilot review round 6

The nesting rule in AGENTS.md was written backwards. "Never nest a budget inside
an equal-or-larger one" forbids the two arrangements this PR deliberately ships
(5s inside 15s, 15s inside 25s) and permits the broken one it exists to prevent.
It now says what it means: an inner budget must be strictly smaller than the
budget enclosing it, arranged by raising the outer rather than shrinking the
inner, since the inner is the bound carrying the useful diagnostic.

The retry scan is structural now rather than a regex. A character class cannot
step over a chain argument containing nested parentheses, so
`it.each([makeCase()])` and `it.skipIf(() => isWindows())` were silently
skipped — the second blind spot of the same kind in two rounds, which is what
makes the pattern the wrong tool. A bracket matcher that skips string literals
handles both, and the positional requirement that keeps fixture data and
`client.retry` out of the results is unchanged. Seven positive forms and six
false-positive shapes are pinned.

The asyncUtilTimeout check read only the first configure() call, so a file
holding the expected call followed by an overriding one passed while its
effective timeout was something else. Every call is inspected and all of them
must agree, which is stricter than checking the last and gives a message naming
the offending value.

Also corrected two PR-description bullets that still described superseded
behavior: the cli child timer stays at 15_000 with the test raised to 25_000,
and AppRenderer's waitFor keeps its 5000 rather than losing it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PsmUAZ6aLUAFqenjJKSSRp
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/verify-test-timeouts.test.mjs

@@ -324,6 +324,11 @@ test("a retry on an individual test or suite is caught", () => {
     `describe("x", { retry: 3 }, () => {});`,
     `it.each([1])("x %i", { retry: 2 }, () => {});`,
     'describe.each([[1, 2]])("x", { retry: 1 }, () => {});',
+    // Nested parentheses in the chain's own argument. A character class cannot
+    // step over either of these, so both were blind spots (Copilot).
+    'it.each([makeCase()])("x", { retry: 2 }, () => {});',
+    'it.skipIf(() => isWindows())("x", { retry: 2 }, () => {});',
+    'it.each`a|b`("x", { retry: 3 }, () => {});',
     `it('single quoted', { timeout: 100, retry: 2 }, () => {});`,
   ]) {
     assert.equal(findTestLevelRetries(src).length, 1, src);
@@ -338,6 +343,8 @@ test("a retry that is not a test option is not a false positive", () => {
     `expect(client.retry).toBe(2);`,
     `it("x", async () => { await withRetries({ retry: 2 }); });`,
     `vi.mock("x", () => ({ retry: 2 }));`,
+    `it("has retry: 2 in the name", () => {});`,
+    `const o = { noRetry: 2 };`,
   ]) {
     assert.deepEqual(findTestLevelRetries(src), [], src);
   }
@@ -386,3 +393,21 @@ test("discovery knows every filename Vitest loads a config from", () => {
       VITEST_CONFIG_FILENAMES.indexOf("vite.config.ts"),
   );
 });
+
+test("every configure() call is inspected, not just the first", () => {
+  // The later call wins at runtime, so approving a file on its first call would
+  // approve one whose effective timeout is something else entirely (Copilot).
+  const overridden = `import { configure } from "storybook/test";
+configure({ asyncUtilTimeout: 1000 });
+configure({ asyncUtilTimeout: 5000 });`;
+  assert.deepEqual(checkAsyncUtilSource(overridden, "storybook/test"), [
+    "configures asyncUtilTimeout as 5000, expected 1000",
+  ]);
+});
+
+test("a configure() call that sets something else does not hide the real one", () => {
+  const source = `import { configure } from "storybook/test";
+configure({ testIdAttribute: "data-testid" });
+configure({ asyncUtilTimeout: 1000 });`;
+  assert.deepEqual(checkAsyncUtilSource(source, "storybook/test"), []);
+});