Fix relocation fsck timeout for large repos

[andrei-hasna]

Summary

• Keeps default hardened Git child-process timeout at 10s.
• Adds a bounded 120s timeout only for the full object-graph git fsck verification in primary relocation planning.
• Adds a focused regression guard that verifies fsck uses the repo-scale timeout.

Why

• Infinity relocation dry-run for hasna/codewith 661->1510 failed closed because git fsck exceeded the previous 10s timeout.
• The same hardened fsck completes read-only in about 21s; three smaller dry-runs already passed.

Verification

• bun test src/db/primary-relocation.test.ts --test-name-pattern guards full object-graph fsck: pass
• bun run typecheck: pass
• bun test: 310 pass, 0 fail, 1017 assertions
• bun run build: pass
• git diff --check: pass
• gitleaks protect --staged --no-banner --redact: no leaks
• gitleaks git --no-banner --redact --log-opts origin/main..HEAD: no leaks
• Source replay of Codewith dry-run produced ok:true, applied:false: /var/tmp/repos-relocation-dryrun-4aa2cb6/codewith-661-1510-source-fix.json

Independent review

• Review A PASS: /var/tmp/repos-fsck-timeout-review-a-b6b4ddd.json sha256 b0c090a182afcbbf0b74efd3c630868a658b51e606af7428bff20cd614f56225
• Review B PASS: /var/tmp/repos-fsck-timeout-review-b-b6b4ddd.json sha256 456f770d0e6cfdf4b17e59ff2ae92c2d534d6edd2dd8068f1098e046d889bf0e

Notes

• This does not authorize or perform relocation apply.
• Current dry-run receipts still report can_apply:false due branch collision decisions that must be reviewed separately before any apply.