fix: sweep wave 3 — the execFileSync family gets timeouts (90 sites, 17 files)

The tripwire's regex covered spawnSync/execSync/Bun.spawnSync but not
execFileSync — an entire blocking sync-spawn API family that could
reintroduce the shard-wedge class undetected (ship review army). Same
mechanical recipe as waves 1-2: timeout: 30_000 default, 120_000 for slow
ops, shared wrappers fixed once, string-needle sites skipped with reasons.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/founder-resources-optout.test.ts

@@ -30,6 +30,7 @@ afterEach(() => { fs.rmSync(tmpHome, { recursive: true, force: true }); });
 
 function cfg(args: string[]): string {
   return execFileSync(CONFIG_BIN, args, {
+    timeout: 30_000,
     encoding: "utf-8",
     env: { ...process.env, GSTACK_HOME: tmpHome },
   }).trim();
@@ -47,6 +48,7 @@ describe("founder_resources config key (#538)", () => {
 
   test("invalid values are rejected to the default, never persisted as-is", () => {
     execFileSync(CONFIG_BIN, ["set", "founder_resources", "banana"], {
+      timeout: 30_000,
       encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, GSTACK_HOME: tmpHome },
     });