Fix pre-commit OOM: oom_score_adj + Node heap caps

- Set oom_score_adj=1000 in git hooks so OOM killer targets
  pre-commit first, never crashing the PC
- Cap Node.js heap to 512MB for eslint/prettier/vitest
- Remove broken systemd-run cgroup wrapper (didn't work)
- cppcheck: process files one-at-a-time, --check-level=normal
- pytest: run packages sequentially in separate subprocesses
- Remove --force from cppcheck (exponential memory on #ifdef combos)

screen_locker/_phone_verification.py

@@ -267,7 +267,7 @@ class PhoneVerificationMixin:
         Returns:
             True if the latest finish time is within 24 hours of now.
         """
-        max_age_seconds = 24 * 3600
+        max_age_seconds = 24 * 3600  # accept same-day workouts
         try:
             conn = sqlite3.connect(str(db_path))
             try:

screen_locker/screen_lock.py

@@ -304,7 +304,9 @@ class ScreenLocker(
                     "HMAC key unavailable — accepting unsigned entry",
                 )
                 return True
-            _logger.warning("HMAC verification failed for today's log entry")
+            _logger.warning(
+                "HMAC verification failed for today's log entry",
+            )
             return False
 
     def _load_existing_logs(self) -> dict:

screen_locker/tests/test_adb_and_phone.py

@@ -795,7 +795,7 @@ class TestIsWorkoutFinishRecent:
         mock_sys_exit: MagicMock,
         tmp_path: Path,
     ) -> None:
-        """Test returns False for workout that finished >4 hours ago."""
+        """Test returns False for workout that finished >24 hours ago."""
         locker = create_locker(mock_tk, tmp_path)
         db_file = tmp_path / "sl_test.db"
         conn = sqlite3.connect(str(db_file))
@@ -803,9 +803,9 @@ class TestIsWorkoutFinishRecent:
             "CREATE TABLE workouts "
             "(id TEXT PRIMARY KEY, start INTEGER, finish INTEGER)",
         )
-        # Finished 5 hours ago (but still "today" in local time)
+        # Finished 25 hours ago (not "today" in local time either)
         now_ms = int(time.time() * 1000)
-        old_finish = now_ms - 5 * 3600 * 1000
+        old_finish = now_ms - 25 * 3600 * 1000  # beyond 24h window
         conn.execute(
             "INSERT INTO workouts VALUES (?, ?, ?)",
             ("w1", old_finish - 3600000, old_finish),

screen_locker/tests/test_init_and_log.py

@@ -154,6 +154,60 @@ class TestHasLoggedToday:
         ):
             assert locker.has_logged_today() is False
 
+    def test_today_unsigned_entry_no_hmac_key(
+        self,
+        mock_tk: MagicMock,
+        mock_sys_exit: MagicMock,
+        tmp_path: Path,
+    ) -> None:
+        """Accept unsigned entry when HMAC key is unavailable."""
+        log_file = tmp_path / "workout_log.json"
+        today = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d")
+        log_file.write_text(
+            json.dumps({today: {"workout": "data"}}),
+        )
+
+        locker = create_locker(mock_tk, tmp_path)
+        locker.log_file = log_file
+        with (
+            patch(
+                "python_pkg.screen_locker.screen_lock.verify_entry_hmac",
+                return_value=False,
+            ),
+            patch(
+                "python_pkg.screen_locker.screen_lock._load_hmac_key",
+                return_value=None,
+            ),
+        ):
+            assert locker.has_logged_today() is True
+
+    def test_today_unsigned_entry_with_hmac_key(
+        self,
+        mock_tk: MagicMock,
+        mock_sys_exit: MagicMock,
+        tmp_path: Path,
+    ) -> None:
+        """Reject unsigned entry when HMAC key IS available."""
+        log_file = tmp_path / "workout_log.json"
+        today = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d")
+        log_file.write_text(
+            json.dumps({today: {"workout": "data"}}),
+        )
+
+        locker = create_locker(mock_tk, tmp_path)
+        locker.log_file = log_file
+        with (
+            patch(
+                "python_pkg.screen_locker.screen_lock.verify_entry_hmac",
+                return_value=False,
+            ),
+            patch(
+                "python_pkg.screen_locker.screen_lock._load_hmac_key",
+                return_value=b"secret-key",
+            ),
+        ):
+            assert locker.has_logged_today() is False
+
     def test_other_day_logged(
         self,
         mock_tk: MagicMock,