fix: sweep — every sync spawn in the test trees carries a timeout (436 sites, 157 files)

spawnSync/execSync/Bun.spawnSync BLOCK the main thread, so bun's in-process
per-test timeout can never fire while one waits — a hung child (stdin read,
network probe, dead daemon) wedges the whole shard until the runner's
external wall-clock SIGKILL. This exact class reached main: free-tests run
33262077256, test/gstack-memory-ingest.test.ts (normally 2.3s) held shard 2
at the 360s wall while its five siblings finished in ~65s.

Mechanical sweep in two waves (12 + 4 fan-out agents, every edit verified
against its call site): default timeout: 30_000 (matches the free runner's
per-test budget), 120_000 for genuinely slow ops (installs, builds,
playwright, provider CLIs), helper wrappers fixed ONCE where call sites
route through them. Sites that only LOOK like calls (string fixtures, grep
needles, comments) were skipped with reasons — the enforcement commit that
follows marks them exempt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/redact-prepush-rebase-force-push.test.ts

@@ -38,7 +38,7 @@ let repo: string;
 let remote: string;
 
 function git(args: string[], cwd = repo): string {
-  const r = spawnSync("git", args, { cwd, encoding: "utf8" });
+  const r = spawnSync("git", args, { cwd, encoding: "utf8", timeout: 30_000 });
   if (r.status !== 0) throw new Error(`git ${args.join(" ")}\n${r.stderr}`);
   return r.stdout?.trim() ?? "";
 }
@@ -56,6 +56,7 @@ function runHook(stdinLines: string): { code: number; stderr: string } {
     cwd: repo,
     input: Buffer.from(stdinLines),
     encoding: "utf8",
+    timeout: 30_000,
     env: { ...process.env },
   });
   return { code: r.status ?? 0, stderr: r.stderr ?? "" };
@@ -115,7 +116,7 @@ describe("rebased force-push does not re-scan upstream commits (#2573)", () => {
     // The rebased tip exists locally and is NOT an ancestor of HEAD — the
     // exact condition #2573 identified as the untested third branch.
     expect(git(["cat-file", "-t", preRebaseTip])).toBe("commit");
-    const isAncestor = spawnSync("git", ["merge-base", "--is-ancestor", preRebaseTip, "HEAD"], { cwd: repo });
+    const isAncestor = spawnSync("git", ["merge-base", "--is-ancestor", preRebaseTip, "HEAD"], { cwd: repo, timeout: 30_000 });
     expect(isAncestor.status).not.toBe(0);
     // What the OLD range would scan: upstream's published fixture included.
     const oldDiff = git(["diff", "--unified=0", `${preRebaseTip}..HEAD`]);