Validate lease timeout against max review runtime

tests/test_config.py

@@ -1,3 +1,6 @@
+import pytest
+from pydantic import ValidationError
+
 from gitea_codex_bot.config import get_settings
 
 
@@ -11,3 +14,12 @@ def test_codex_auth_defaults_to_api_key_mode() -> None:
     settings = get_settings()
     assert settings.codex_auth_mode == "api_key"
     assert settings.codex_auth_json_path is None
+
+
+def test_job_lease_timeout_must_cover_max_review_runtime(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("MAX_REVIEW_MINUTES", "10")
+    monkeypatch.setenv("JOB_LEASE_TIMEOUT_SECONDS", "300")
+    get_settings.cache_clear()
+
+    with pytest.raises(ValidationError, match="JOB_LEASE_TIMEOUT_SECONDS must be at least"):
+        get_settings()