refactor(lib): shared isExecTimeout helper; export GbrainBinProbe

The killed/SIGTERM/ETIMEDOUT discrimination was hand-rolled at three sites
(gbrain version probe, engine classifier, gitleaks probe) and free to
drift; it now lives once in lib/gbrain-exec.ts. GbrainBinProbe is exported
(it's the return type of exported probeGbrainBin) and the cache carries a
rationale comment: caching a timeout for process lifetime is deliberate —
the memo dedupes the ~3 probes of one short-lived preamble process.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/gbrain-exec.ts

@@ -149,6 +149,19 @@ export function buildGbrainEnv(opts: BuildGbrainEnvOptions = {}): NodeJS.Process
  */
 export const NEEDS_SHELL_ON_WINDOWS = process.platform === "win32";
 
+/**
+ * Did an execFileSync/spawnSync failure come from the TIMEOUT budget (child
+ * killed) rather than the child itself failing? execFileSync kills the child
+ * when the budget runs out: `killed` with a SIGTERM on POSIX, ETIMEDOUT on
+ * runtimes that surface errno instead. Shared by the gbrain version probe,
+ * the engine classifier, and the gitleaks probe so the three sites can't
+ * drift on which shapes count as "slow, not broken".
+ */
+export function isExecTimeout(err: unknown): boolean {
+  const e = err as { killed?: boolean; signal?: string; code?: unknown };
+  return e?.killed === true || e?.signal === "SIGTERM" || e?.code === "ETIMEDOUT";
+}
+
 /** Where Git for Windows puts bash, most-specific first. */
 const WINDOWS_BASH_CANDIDATES = [
   "C:\\Program Files\\Git\\bin\\bash.exe",