fix: sweep — every sync spawn in the test trees carries a timeout (436 sites, 157 files)

spawnSync/execSync/Bun.spawnSync BLOCK the main thread, so bun's in-process
per-test timeout can never fire while one waits — a hung child (stdin read,
network probe, dead daemon) wedges the whole shard until the runner's
external wall-clock SIGKILL. This exact class reached main: free-tests run
33262077256, test/gstack-memory-ingest.test.ts (normally 2.3s) held shard 2
at the 360s wall while its five siblings finished in ~65s.

Mechanical sweep in two waves (12 + 4 fan-out agents, every edit verified
against its call site): default timeout: 30_000 (matches the free runner's
per-test budget), 120_000 for genuinely slow ops (installs, builds,
playwright, provider CLIs), helper wrappers fixed ONCE where call sites
route through them. Sites that only LOOK like calls (string fixtures, grep
needles, comments) were skipped with reasons — the enforcement commit that
follows marks them exempt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

browse/test/file-permissions.test.ts

@@ -87,7 +87,7 @@ describe('restrictDirectoryPermissions', () => {
     fs.mkdirSync(d);
     // System chmod, not fs.chmodSync: Bun masks the sticky bit off chmod/
     // mkdir modes, so 0o1777 through the fs API lands as 0o777.
-    Bun.spawnSync(['chmod', '1777', d]);
+    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
     restrictDirectoryPermissions(d);
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);
@@ -244,7 +244,7 @@ describe('mkdirSecure', () => {
     fs.mkdirSync(d);
     // System chmod: Bun's fs API masks the sticky bit off modes (see the
     // restrictDirectoryPermissions sticky-dir test).
-    Bun.spawnSync(['chmod', '1777', d]);
+    Bun.spawnSync(['chmod', '1777', d], { timeout: 30_000 });
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777); // fixture took
     mkdirSecure(d);
     expect(fs.statSync(d).mode & 0o7777).toBe(0o1777);