fix(time): address Copilot review nits

- safari: guard float64 seconds against out-of-range conversion to
  int64 (Go spec makes those implementation-dependent); bound by
  maxCoreDataSeconds so year clamp at the end becomes unnecessary.
- firefox: correct clampJSON's documented range to [1, 9999] so the
  comment matches the predicate.
- tests: swap assert.Equal for assert.Same on UTC location checks, so
  any leaked time.Local is caught via pointer identity regardless of
  the runner's TZ (t.Setenv was ineffective since time.Local is cached
  at process init).

Author: moonD4rk

browser/chromium/chromium_test.go

@@ -743,9 +743,11 @@ func TestTimeEpoch_NegativeReturnsZeroTime(t *testing.T) {
 }
 
 func TestTimeEpoch_AlwaysUTC(t *testing.T) {
-	t.Setenv("TZ", "Asia/Shanghai")
+	// assert.Same checks pointer equality: time.UTC and time.Local are
+	// distinct *Location globals, so this catches any regression that
+	// drops .UTC() even when the runner's TZ happens to be UTC.
 	got := timeEpoch(anchorChromiumMicros)
-	assert.Equal(t, time.UTC, got.Location())
+	assert.Same(t, time.UTC, got.Location())
 }
 
 func TestTimeEpoch_MicrosecondPrecisionPreserved(t *testing.T) {

browser/firefox/firefox.go

@@ -315,7 +315,7 @@ func firefoxSeconds(s int64) time.Time {
 	return clampJSON(time.Unix(s, 0).UTC())
 }
 
-// clampJSON maps years outside time.Time.MarshalJSON's [0, 9999] window
+// clampJSON maps years outside time.Time.MarshalJSON's [1, 9999] window
 // to the zero time, so JSON export can't crash on sentinel inputs.
 func clampJSON(t time.Time) time.Time {
 	if t.Year() < 1 || t.Year() > 9999 {

browser/firefox/firefox_test.go

@@ -361,10 +361,11 @@ func TestFirefoxHelpers_NegativeReturnsZeroTime(t *testing.T) {
 }
 
 func TestFirefoxHelpers_AlwaysUTC(t *testing.T) {
-	t.Setenv("TZ", "Asia/Shanghai")
-	assert.Equal(t, time.UTC, firefoxMicros(anchorUnixSeconds*1_000_000).Location())
-	assert.Equal(t, time.UTC, firefoxMillis(anchorUnixSeconds*1_000).Location())
-	assert.Equal(t, time.UTC, firefoxSeconds(anchorUnixSeconds).Location())
+	// assert.Same: pointer equality reliably catches any helper that
+	// leaks time.Local, independent of the runner's configured TZ.
+	assert.Same(t, time.UTC, firefoxMicros(anchorUnixSeconds*1_000_000).Location())
+	assert.Same(t, time.UTC, firefoxMillis(anchorUnixSeconds*1_000).Location())
+	assert.Same(t, time.UTC, firefoxSeconds(anchorUnixSeconds).Location())
 }
 
 func TestFirefoxHelpers_SameMomentAcrossUnits(t *testing.T) {

browser/safari/safari.go

@@ -215,18 +215,20 @@ func resolveSourcePaths(sources map[types.Category][]sourcePath) map[types.Categ
 // Offset from the Core Data epoch (2001-01-01 UTC) to the Unix epoch.
 const coreDataEpochOffset = 978307200
 
+// maxCoreDataSeconds is the largest CFAbsoluteTime that still lands inside
+// time.Time.MarshalJSON's [1, 9999] year window. Also bounds the float →
+// int64 conversion below; Go's spec makes out-of-range conversions return
+// an implementation-dependent int64, which could silently corrupt results.
+const maxCoreDataSeconds = 252423993600
+
 // coredataTimestamp converts Core Data seconds (CFAbsoluteTime) to UTC.
 // Returns zero for non-positive input or out-of-JSON-range values.
 func coredataTimestamp(seconds float64) time.Time {
-	if seconds <= 0 {
+	if seconds <= 0 || seconds > maxCoreDataSeconds {
 		return time.Time{}
 	}
 	whole := int64(seconds)
 	frac := seconds - float64(whole)
 	nanos := int64(frac * 1e9)
-	t := time.Unix(whole+coreDataEpochOffset, nanos).UTC()
-	if t.Year() < 1 || t.Year() > 9999 {
-		return time.Time{}
-	}
-	return t
+	return time.Unix(whole+coreDataEpochOffset, nanos).UTC()
 }

browser/safari/safari_test.go

@@ -359,7 +359,8 @@ func TestCoredataTimestamp_FractionalSecondsPreserved(t *testing.T) {
 }
 
 func TestCoredataTimestamp_AlwaysUTC(t *testing.T) {
-	t.Setenv("TZ", "Asia/Shanghai")
+	// assert.Same: pointer equality reliably catches any regression that
+	// leaks time.Local, independent of the runner's configured TZ.
 	got := coredataTimestamp(float64(anchorCoreDataSeconds))
-	assert.Equal(t, time.UTC, got.Location())
+	assert.Same(t, time.UTC, got.Location())
 }