fix: sweep wave 3 — the execFileSync family gets timeouts (90 sites, 17 files)

The tripwire's regex covered spawnSync/execSync/Bun.spawnSync but not
execFileSync — an entire blocking sync-spawn API family that could
reintroduce the shard-wedge class undetected (ship review army). Same
mechanical recipe as waves 1-2: timeout: 30_000 default, 120_000 for slow
ops, shared wrappers fixed once, string-needle sites skipped with reasons.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/mktemp-portability.test.ts

@@ -23,6 +23,7 @@ function trackedTmplFiles(): string[] {
   const out = execFileSync("git", ["ls-files", "*.tmpl", "**/*.tmpl"], {
     cwd: ROOT,
     encoding: "utf-8",
+    timeout: 30_000,
   });
   return out.split("\n").filter(Boolean);
 }
@@ -50,8 +51,9 @@ describe("mktemp portability (#2091)", () => {
     const tmp = process.env.TMPDIR || "/tmp";
     const created = execFileSync("mktemp", [`${tmp.replace(/\/$/, "")}/gstack-portability-XXXXXX`], {
       encoding: "utf-8",
+      timeout: 30_000,
     }).trim();
     expect(created.length).toBeGreaterThan(0);
-    execFileSync("rm", ["-f", created]);
+    execFileSync("rm", ["-f", created], { timeout: 30_000 });
   });
 });