fix(hooks): bound foreground hook time to stay under host 10s cap

[jeff-r2026]

Problem

Foreground (inline) hooks block the host IDE and are aborted at ~10s regardless of the declared timeout — even Stop/SessionStart (declared 15s) are killed at 10000ms, reporting Hook timed out after 10000ms (error 3003) and breaking the IDE. Two paths could hit this:

1. A slow/unreachable HTTP endpoint (local-agent report/sync) in a foreground handler.
2. readStdin's for await (process.stdin) hanging forever when the host writes the payload but never sends EOF — this happens before any handler timeout can engage.

Changes (layered bounds)

• hook-handlers: unify every foreground handler timeout to 4.5s (FOREGROUND_HOOK_TIMEOUT_MS); detached background handlers keep their full budget.
• local-agent: cap per-fetch timeout at 3s inside foreground hooks (SessionStart / UserPromptSubmit); background (detached) runs keep the full 15s to finish real syncs/downloads.
• hook-dispatch-cli: readStdin races a 2s deadline — a host that writes the payload but never sends EOF no longer hangs the process; we proceed with the buffered payload.
• index: 7s hard-exit safety net for the foreground hook process (below the 10s host cap, above the 4.5s handler budget). The detached --bg-only child is exempt and keeps its full budget.

Healthy endpoints answer well under a second, so these bounds are invisible in normal use; they only cap the worst case.

Tests

Added regression tests asserting every foreground handler timeout stays under 5s and that foreground local-agent-sync timeouts are unified. npm run build + vitest (hook-handlers 21 + local-agent 38) all green.