test(#4519): migrate security-scanner batch to named timeout constants

Batch 8 of 17 in the ad hoc timeout literal migration (epic #4445).
Replaces every bare numeric timeout/timeoutMs object-literal property in
tests/secret-scan-lint.security.test.cjs, tests/security-scan.security.test.cjs,
tests/security-prompt-injection.security.test.cjs, tests/prompt-injection-scan.security.test.cjs,
tests/read-injection-scanner.security.test.cjs, tests/read-injection-scanner.property.test.cjs,
and tests/security.test.cjs with a named constant, per
eslint-rules/no-adhoc-timeout-literal.cjs. Removes the 7 files from the
rule's allowlist.

The issue guessed this batch "most likely needs its own named
SCAN_TIMEOUT_MS." Reading every one of the 19 call sites directly found a
more specific picture: 8 sites across 3 files scan exactly one small temp
fixture file and match the existing QUICK_SPAWN_TIMEOUT_MS class exactly
(reused, no new constant). Two new shared constants cover genuinely
distinct classes that happen to coincide in value:
SCAN_USAGE_ERROR_TIMEOUT_MS (a bash scan script given missing arguments)
and MALFORMED_INPUT_HOOK_TIMEOUT_MS (a Node hook fed malformed JSON) --
kept as separate names per this migration's standing rule that numeric
coincidence is never identity. Three file-local constants cover a real
multi-file directory scan, a property-fuzzing safety net, and a
path-traversal hook test, each with its own pre-existing rationale
preserved.

No bound is lowered or raised anywhere in this batch, honoring the
issue's explicit caution that security-scan timing margins deserve
extra scrutiny. No src/bin file touched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/security-scan.security.test.cjs

@@ -42,7 +42,19 @@ const path = require('path');
 const { cleanup, createTempGitProject } = require('./helpers.cjs');
 const { runHook } = require('./helpers/process-seam.cjs');
 const { gitOrThrow, GIT_FIXTURE_TIMEOUT_MS } = require('./helpers/git-fixture.cjs');
-const { HOOK_FANOUT_TIMEOUT_MS } = require('./helpers/timeouts.cjs');
+const {
+  HOOK_FANOUT_TIMEOUT_MS,
+  QUICK_SPAWN_TIMEOUT_MS,
+  SCAN_USAGE_ERROR_TIMEOUT_MS,
+} = require('./helpers/timeouts.cjs');
+
+// Bounds base64-scan.sh under the locale-regression scenario (see the
+// comment above the describe block below): a dir/file scan with non-UTF8
+// content under a non-C locale must complete cleanly within 30s. Numerically
+// coincides with timeouts.cjs's BUILD_TIMEOUT_MS (an unrelated
+// hooks-bundle-build operation) but matches neither that nor any other
+// existing shared constant, so it stays file-local.
+const BASE64_LOCALE_SCAN_TIMEOUT_MS = 30000;
 
 const PROJECT_ROOT = path.join(__dirname, '..');
 const SCRIPTS = {
@@ -68,7 +80,7 @@ function runScript(scriptPath, content, extraArgs) {
     const result = execFileSync(scriptPath, args, {
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
-      timeout: 10000,
+      timeout: QUICK_SPAWN_TIMEOUT_MS,
     });
     return { status: 0, stdout: result, stderr: '' };
   } catch (err) {
@@ -201,7 +213,7 @@ describe('prompt-injection-scan.sh', { skip: IS_WINDOWS }, () => {
       execFileSync(SCRIPTS.injection, [], {
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: 5000,
+        timeout: SCAN_USAGE_ERROR_TIMEOUT_MS,
       });
       assert.fail('Should have exited non-zero');
     } catch (err) {
@@ -218,7 +230,7 @@ describe('prompt-injection-scan.sh', { skip: IS_WINDOWS }, () => {
 function runScriptOnDir(scriptPath, dirPath, env) {
   const result = spawnSync('bash', [scriptPath, '--dir', dirPath], {
     encoding: 'utf-8',
-    timeout: 30000,
+    timeout: BASE64_LOCALE_SCAN_TIMEOUT_MS,
     env: { ...process.env, ...env },
   });
   return {
@@ -233,7 +245,7 @@ function runScriptOnDir(scriptPath, dirPath, env) {
 function runScriptOnFile(scriptPath, filePath, env) {
   const result = spawnSync('bash', [scriptPath, '--file', filePath], {
     encoding: 'utf-8',
-    timeout: 30000,
+    timeout: BASE64_LOCALE_SCAN_TIMEOUT_MS,
     env: { ...process.env, ...env },
   });
   return {
@@ -292,7 +304,7 @@ describe('base64-scan.sh', { skip: IS_WINDOWS }, () => {
       execFileSync(SCRIPTS.base64, [], {
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: 5000,
+        timeout: SCAN_USAGE_ERROR_TIMEOUT_MS,
       });
       assert.fail('Should have exited non-zero');
     } catch (err) {
@@ -504,7 +516,7 @@ describe('secret-scan.sh', { skip: IS_WINDOWS }, () => {
       execFileSync(SCRIPTS.secret, [], {
         encoding: 'utf-8',
         stdio: ['pipe', 'pipe', 'pipe'],
-        timeout: 5000,
+        timeout: SCAN_USAGE_ERROR_TIMEOUT_MS,
       });
       assert.fail('Should have exited non-zero');
     } catch (err) {