fix: harden compiled profile bootstrap

[wolverin0]

Summary

• derive transient mapper candidate IDs deterministically instead of trusting provider scalar types
• bound initial GLM mapping prompts to 200k characters
• allow a 300-second profile provider timeout

Verification

• 10 focused profile tests pass
• Ruff passes for touched profile/test modules
• real OAuth-backed GLM mapper smoke returns a validated candidate