A three-day Dependabot delay and a 14-day PyPI upload cutoff show how software platforms are turning timing into a supply-chain defense.