fix(snapshot): bound git subprocesses so a wedged git cannot stall the turn

[asto18089]

Summary

The snapshot side repo shelled out to git with blocking Command::output calls that have no time bound: a wedged git — a stalled NFS/FUSE mount, lock contention, a hung hook — blocks the per-turn snapshot path, the restore path, and the prune path indefinitely. Every caller already treats a snapshot error as snapshot-disabled-with-warning, so the bound only has to surface as a normal error to degrade gracefully.

All three unbounded call sites in snapshot/repo.rs — the one-time git init, the date-pinned commit-tree on the per-turn prune path, and the shared run_git helper — now route through one bounded core with a 300s budget (git add -A on a large workspace is legitimately slow). The core drains both pipes while the child runs, exactly what Command::output does: the restore path's ls-tree -r and the diff commands emit output that grows with workspace size, and a child blocked on a full pipe buffer never exits, which would turn every such call into a guaranteed timeout. After git exits, the drain collect is bounded by a short grace so a grandchild that inherited the pipes (a daemonizing post-checkout hook, a gc pack worker) cannot hold the call either. On timeout the child is killed and reaped on a detached thread — on a hard-wedged mount the kernel may not deliver SIGKILL until an uninterruptible syscall returns — and the caller gets io::ErrorKind::TimedOut. Killing without git's own cleanup can leave a fresh index.lock; later snapshots then fail fast on the lock with an error naming it.

Tests: a wedged child with a short injected budget fails with TimedOut promptly; a grandchild holding the pipes cannot hold the call past the grace; a 5000-file tree listing (above the 64 KiB pipe buffer) still drains instead of dying at the command timeout.

Known follow-up: snapshot/delta.rs's read-view git calls (diff-tree, ls-tree, cat-file) are not yet bounded; same wedge class, read-view commands, left for a follow-up.

Testing

• cargo test -p codewhale-tui --lib snapshot — the bounded core's behavioral tests (real children: timeout, grandchild drain grace, large-output drain)
• cargo clippy -p codewhale-tui --all-targets --all-features --locked
• cargo fmt --all -- --check

Adapted from the Pinvou fork's timeout audit (Pinvou/CodeWhale d349f2537, the snapshot slice), reworked onto the current snapshot architecture.

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• No CHANGELOG.md changes