fix: sweep wave 3 — the execFileSync family gets timeouts (90 sites, 17 files)

The tripwire's regex covered spawnSync/execSync/Bun.spawnSync but not
execFileSync — an entire blocking sync-spawn API family that could
reintroduce the shard-wedge class undetected (ship review army). Same
mechanical recipe as waves 1-2: timeout: 30_000 default, 120_000 for slow
ops, shared wrappers fixed once, string-needle sites skipped with reasons.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/gstack-learnings-search.test.ts

@@ -16,6 +16,7 @@ const otherProjDir = path.join(tmpHome, 'projects', 'other-project');
 
 function run(args: string[]): string {
   return execFileSync(BIN, args, {
+    timeout: 30_000,
     env: { ...process.env, GSTACK_HOME: tmpHome },
     cwd: tmpCwd,
     encoding: 'utf-8',