fix(memory-helpers): per-run cooldown bounds the slow-gitleaks probe cost

Retrying a slow probe per FILE (#2715's slow!=absent split) re-paid up to
probe+retry (12s default) per file — an 887-file ingest on a loaded box
spent hours re-asking the same slow question. After 3 consecutive slow
answers the run stops probing and warns once that remaining files go
unscanned; the availability cache is still never written, so the next
process probes fresh. Slow/absent discrimination is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-memory-helpers.test.ts

@@ -276,6 +276,34 @@ exit 2
     }
   });
 
+  it("stops probing after 3 consecutive slow answers (per-run cooldown), never caching unavailability", () => {
+    const dir = mkdtempSync(join(tmpdir(), "gstack-test-"));
+    const binDir = join(dir, "bin");
+    const log = join(dir, "calls.log");
+    const file = join(dir, "clean.txt");
+    writeFileSync(file, "no secrets here\n");
+    // Empty marker: EVERY call hangs, so both budgets expire on each probe.
+    fakeGitleaks(binDir, log, "");
+    try {
+      _setGitleaksProbeTimeouts(800, 800);
+      // Three slow rounds: each pays probe+retry (2 spawns), each unscanned.
+      for (let i = 0; i < 3; i++) {
+        const r = withFakeOnPath(binDir, () => secretScanFile(file));
+        expect(r.scanner).toBe("missing");
+      }
+      const probesAtLimit = versionProbes(log);
+      expect(probesAtLimit).toBe(6);
+      // Fourth file: cooldown short-circuits — no spawn, still unscanned,
+      // and the question stays open for the NEXT process (cache never set).
+      const fourth = withFakeOnPath(binDir, () => secretScanFile(file));
+      expect(fourth.scanner).toBe("missing");
+      expect(versionProbes(log)).toBe(probesAtLimit);
+      expect(_gitleaksCacheState()).toBeNull();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("caches an absent binary, so it is probed once per process", () => {
     const dir = mkdtempSync(join(tmpdir(), "gstack-test-"));
     const binDir = join(dir, "empty-bin");