test: sync-spawn timeout tripwire — the wedge class stays extinct

Free scanner over all test trees (test/, browse/test/, design/test/,
make-pdf/test/, ios-qa, browser-skills): every spawnSync/execSync/
Bun.spawnSync call site must carry a timeout within a 30-line options
window, or an explicit '// tripwire-exempt: <reason>' marker. Comment
lines are skipped; exemptions are counted and ratcheted shrink-only
(ceiling 6 = the 6 string-fixture/grep-needle sites where the pattern is
CONTENT, not a call — marked in this commit). A scan-sanity test pins that
the scanner still sees >100 real call sites so it can never rot to a
vacuous green. Companion to the 436-site sweep in the previous commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/test-free-shards.test.ts

@@ -83,6 +83,7 @@ describe('test-free-shards: Windows curation', () => {
   });
 
   test('detects spawn("sh", ...)', () => {
+    // tripwire-exempt: string fixture fed to detectWindowsFragility, not a call
     withTempFile(`spawnSync('sh', ['-c', 'command -v claude']);`, (f) => {
       expect(detectWindowsFragility(f)?.reason).toBe('spawn("sh", ...)');
     });
@@ -95,6 +96,7 @@ describe('test-free-shards: Windows curation', () => {
   });
 
   test('detects which claude shell command', () => {
+    // tripwire-exempt: string fixture fed to detectWindowsFragility, not a call
     withTempFile(`execSync('which claude').trim();`, (f) => {
       expect(detectWindowsFragility(f)?.reason).toBe('which claude (use Bun.which)');
     });