test: sync-spawn timeout tripwire — the wedge class stays extinct

Free scanner over all test trees (test/, browse/test/, design/test/,
make-pdf/test/, ios-qa, browser-skills): every spawnSync/execSync/
Bun.spawnSync call site must carry a timeout within a 30-line options
window, or an explicit '// tripwire-exempt: <reason>' marker. Comment
lines are skipped; exemptions are counted and ratcheted shrink-only
(ceiling 6 = the 6 string-fixture/grep-needle sites where the pattern is
CONTENT, not a call — marked in this commit). A scan-sanity test pins that
the scanner still sees >100 real call sites so it can never rot to a
vacuous green. Companion to the 436-site sweep in the previous commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/skill-e2e-triage.test.ts

@@ -101,6 +101,7 @@ const path = require('path');
 let failures = 0;
 for (const f of ['math.test.js', 'string.test.js']) {
   try {
+    // tripwire-exempt: line below is CONTENT of the generated run.js fixture (child-executed), not a test-process call
     execSync('node ' + path.join(__dirname, f), { stdio: 'inherit' });
   } catch (e) {
     failures++;