test: stop the suite flaking on real-git and real-PTY fixtures

`npm test` was failing 5-11 tests per run with the set shifting between runs,
which made it useless as a gate. Two independent causes, neither of them a
product defect.

1. Fixtures had outgrown vitest's 5 s default. The git ones spawn 6-12
   sequential `git` processes (init/config/commit/clone/push); the real-server
   ones boot a server and a shell. Alone they finish easily; under a full
   parallel run they do not, and the failure reads `Test timed out in 5000ms`.
   Gave those describes an explicit 30 s ceiling, and the real-PTY waits a
   named PTY_WAIT_MS. The deliberate short bounds in the "must be rejected"
   handshake tests are left alone — there a timeout IS the assertion.
   (The same rebudgeting also touched the test files in the preceding commit.)

2. test/integration/server.test.ts cannot share the machine with the rest of
   the suite. It asserts on real prompt output within seconds, which is not
   achievable while ~8 workers saturate the box: it passed alone (27/27,
   repeatedly) and flaked in the full run. Raising the numbers further only
   moved the flake around, so this is fixed as a scheduling problem — `npm
   test` now runs two passes, `test:unit` (everything else, parallel) then
   `test:e2e` (that file on its own). `vitest run` still runs everything at
   once for anyone who wants that.

Also bounded the srv.close() in H1's finally. Unbounded, it swallowed whatever
really went wrong in the body — the inner waits threw, control jumped to the
finally, close() blocked, and the case reported a bare timeout instead of its
own diagnosis. The root-causing above only became possible after making that
failure legible.

Note on the `[needs real PTY (sandbox-off)]` labels: those cases were NOT
skipping here. PTY_AVAILABLE is true on this machine, so they were running and
failing on timing, not being gated out by a sandbox.

Verified: npm test green end to end across repeated runs (unit 78 files /
2147 tests, e2e 27).

test/integration/git-ops.test.ts

@@ -118,7 +118,7 @@ afterEach(async () => {
 
 const ROUTES = ['/projects/git/stage', '/projects/git/commit', '/projects/git/push'] as const
 
-describe('git-write routes — shared guards (CSRF / kill-switch)', () => {
+describe('git-write routes — shared guards (CSRF / kill-switch)', { timeout: 30_000 }, () => {
   for (const route of ROUTES) {
     it(`${route}: rejects a foreign Origin with 403`, async () => {
       const { port } = await spawnServer()
@@ -142,7 +142,7 @@ describe('git-write routes — shared guards (CSRF / kill-switch)', () => {
 
 // ── POST /projects/git/stage ──────────────────────────────────────────────────────
 
-describe('POST /projects/git/stage', () => {
+describe('POST /projects/git/stage', { timeout: 30_000 }, () => {
   it('returns 400 when files are missing', async () => {
     const { port, origin } = await spawnServer()
     const res = await postJson(port, '/projects/git/stage', { path: '/tmp/x' }, { Origin: origin })
@@ -173,7 +173,7 @@ describe('POST /projects/git/stage', () => {
 
 // ── POST /projects/git/commit ─────────────────────────────────────────────────────
 
-describe('POST /projects/git/commit', () => {
+describe('POST /projects/git/commit', { timeout: 30_000 }, () => {
   itGit('returns 400 for an empty message', async () => {
     const repo = await makeRealRepo()
     const { port, origin } = await spawnServer()
@@ -210,7 +210,7 @@ describe('POST /projects/git/commit', () => {
 
 // ── POST /projects/git/push ───────────────────────────────────────────────────────
 
-describe('POST /projects/git/push', () => {
+describe('POST /projects/git/push', { timeout: 30_000 }, () => {
   itGit('returns a safe 400 when the repo has no remote', async () => {
     const repo = await makeRealRepo()
     const { port, origin } = await spawnServer()