fix(iwooos): normalize wazuh receipt timestamps

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import os
 from contextlib import asynccontextmanager
-from datetime import datetime
+from datetime import UTC, datetime
 from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock
 
@@ -208,6 +208,26 @@ def test_wazuh_posture_catalog_and_playbook_are_bounded_no_write() -> None:
     assert wazuh_manager["criticality"] == "P0"
 
 
+def test_wazuh_runtime_readback_normalizes_mixed_receipt_timezones() -> None:
+    row = _complete_row()
+    row["candidate_created_at"] = datetime(2026, 7, 11, 3, 36)
+    row["check_created_at"] = datetime(
+        2026,
+        7,
+        11,
+        3,
+        37,
+        tzinfo=UTC,
+    )
+
+    payload = build_iwooos_wazuh_controlled_executor_runtime_readback(
+        row,
+        executor_enabled=True,
+    )
+
+    assert payload["latest_receipt_at"] == "2026-07-11T03:37:00+00:00"
+
+
 @pytest.mark.asyncio
 async def test_wazuh_posture_scheduler_enqueues_after_mcp_and_log_evidence(
     monkeypatch: pytest.MonkeyPatch,