test(#4520): migrate generators/doc-gates/attribution batch to named timeout constants

Batch 9 of 17 in the ad hoc timeout literal migration (epic #4445).
Replaces every bare numeric timeout/timeoutMs object-literal property in
14 files with a named constant, per eslint-rules/no-adhoc-timeout-literal.cjs.
Removes the 14 files from the rule's allowlist.

The issue's own guess ("all run a scripts/*.cjs generator or lint script
once, BUILD_TIMEOUT_MS class") needed two corrections found by reading
every site directly. First, BUILD_TIMEOUT_MS's own doc comment scopes it
specifically to scripts/build-hooks.js, which none of this batch's
generator/lint-script sites run — a new shared constant,
GENERATOR_SCRIPT_TIMEOUT_MS, covers the class instead. Second,
no-pending-3212-markers.test.cjs's single site spawns `git ls-files`
directly, not a scripts/*.cjs script at all — routed to a second new
shared constant, REAL_REPO_GIT_TIMEOUT_MS, promoted once
emitted-attribution.test.cjs's own git-plumbing sites were found sharing
the same class and value.

Isolated Standards-axis review caught a further misclassification: one
of REAL_REPO_GIT_TIMEOUT_MS's three emitted-attribution.test.cjs sites
actually builds a fresh throwaway temp repo (createTempDir + git init),
contradicting that constant's own real-repo-tree-only scope. Fixed with
a new file-local FRESH_FIXTURE_GIT_TIMEOUT_MS holding the exact
pre-existing value under an honest name, rather than reusing the shared
GIT_FIXTURE_TIMEOUT_MS (which would have doubled the bound).

emitted-attribution.test.cjs also gets two more file-local constants:
HEAVY_REAL_TREE_TEST_TIMEOUT_MS (node:test's own per-test timeout
option, not a spawn bound) and BUILD_HOOKS_UNDER_LOAD_TIMEOUT_MS (the
same build-hooks.js script as the shared norm, at 4x its bound inside
the suite's heaviest test). emitted-ack-trailer.test.cjs gets
IMPOSSIBLY_SHORT_GIT_TIMEOUT_MS — the one value in this migration that
is deliberately tiny (20ms), used to force a timeout in a negative test,
not generous headroom.

No src/bin file touched, no numeric value changed anywhere.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/emitted-attribution.test.cjs

@@ -90,6 +90,56 @@ const {
   resolveBaseline,
 } = require('./helpers/emitted-baseline.cjs');
 
+/**
+ * git plumbing via a scratch index against this repo's REAL object
+ * database (never a throwaway fixture) -- run through this file's own
+ * hand-rolled git-spawn helper (never the shared
+ * tests/helpers/git-fixture.cjs). Shares the REAL_REPO_GIT_TIMEOUT_MS class
+ * with tests/no-pending-3212-markers.test.cjs's `git ls-files` call --
+ * promoted to tests/helpers/timeouts.cjs rather than kept file-local once a
+ * second file was found sharing the exact same value and shape.
+ */
+const { REAL_REPO_GIT_TIMEOUT_MS } = require('./helpers/timeouts.cjs');
+
+/**
+ * git fixture CONSTRUCTION (init/config/add/commit) against a genuinely
+ * fresh temp repo, via this file's own hand-rolled git-spawn helper --
+ * correction from an earlier pass that conflated this with
+ * REAL_REPO_GIT_TIMEOUT_MS's real-repo-tree class; a Standards-axis review
+ * caught that this site's `repo` is a throwaway mkdtemp fixture
+ * (createTempDir + git init), not the real repo tree. Distinct from the
+ * SHARED tests/helpers/git-fixture.cjs's own GIT_FIXTURE_TIMEOUT_MS
+ * (60000ms, a six-spawn construction sequence): this site rolls its own,
+ * lighter five-spawn sequence at a genuinely different pre-existing bound,
+ * so reusing that shared constant would silently double this site's
+ * budget. No fresh bench data justifies a different number, so the
+ * pre-existing 30000ms literal is preserved exactly under this name.
+ */
+const FRESH_FIXTURE_GIT_TIMEOUT_MS = 30_000;
+
+/**
+ * node:test's own per-test timeout option (NOT a subprocess spawn bound) --
+ * bounds the whole test body for this file's two heaviest tests: a real
+ * worktree checkout, `npm run build:lib`, a full multi-runtime install
+ * pass, and real git resolution. A completely different mechanism from
+ * every spawnSync/execFileSync timeout in this file or in
+ * tests/helpers/timeouts.cjs. No fresh bench data justifies a different
+ * number, so the pre-existing 480000ms literal is preserved exactly.
+ */
+const HEAVY_REAL_TREE_TEST_TIMEOUT_MS = 480_000;
+
+/**
+ * Runs the exact same script as the shared BUILD_TIMEOUT_MS constant
+ * (scripts/build-hooks.js) but at 4x that constant's bound. This site
+ * sits inside "differential attribution over the real tree", the single
+ * heaviest test in the suite, where elevated system load plausibly
+ * justifies the wider margin -- not equalized to the lighter shared norm
+ * without bench data. Coincides numerically with INSTALL_TIMEOUT_MS (a
+ * full installer run, an unrelated operation) -- kept separate. No fresh
+ * bench data justifies a different number, so the pre-existing 120000ms
+ * literal is preserved exactly.
+ */
+const BUILD_HOOKS_UNDER_LOAD_TIMEOUT_MS = 120_000;
 
 const SHA_A = 'a'.repeat(40);
 const SHA_B = 'b'.repeat(40);
@@ -1425,7 +1475,7 @@ test('an unreadable baseline surfaces an error', () => {
 test(
   'buildBaselineAtRef resolves a baseline via the in-job build even when the generator '
   + 'script is absent at the ref (#2767 regression)',
-  { timeout: 480_000 },
+  { timeout: HEAVY_REAL_TREE_TEST_TIMEOUT_MS },
   (t) => {
     // Mirrors "differential attribution over the real tree": install output is
     // platform-specific on Windows, and this drives the same heavy worktree +
@@ -1476,7 +1526,7 @@ test(
     // closed. Reusing the SAME helper `buildBaselineAtRef` now uses (below) rather than
     // hand-rolling the flag here keeps the fix from silently diverging per call site.
     const run = (...args) => execFileSync('git', [...safeDirArgs(REPO_ROOT), ...args], {
-      cwd: REPO_ROOT, encoding: 'utf8', timeout: 30_000, env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'],
+      cwd: REPO_ROOT, encoding: 'utf8', timeout: REAL_REPO_GIT_TIMEOUT_MS, env: gitEnv, stdio: ['ignore', 'pipe', 'pipe'],
     }).trim();
 
     const headSha = run('rev-parse', 'HEAD');
@@ -1492,7 +1542,7 @@ test(
     // otherwise this test would prove nothing.
     assert.throws(
       () => execFileSync('git', [...safeDirArgs(REPO_ROOT), 'cat-file', '-e', `${syntheticSha}:scripts/gen-emitted-baseline.cjs`], {
-        cwd: REPO_ROOT, encoding: 'utf8', timeout: 30_000, stdio: 'pipe',
+        cwd: REPO_ROOT, encoding: 'utf8', timeout: REAL_REPO_GIT_TIMEOUT_MS, stdio: 'pipe',
       }),
       /./,
       'the synthetic ref must genuinely lack the generator script for this test to prove anything',
@@ -1936,7 +1986,7 @@ test('baseline families are enumerated from the ref, not from the current regist
   // this same process just created with `mkdtempSync` + `git init`, so its owner is
   // always the uid running the test regardless of container — it is never the
   // externally-mounted repo path the dubious-ownership check reacts to.
-  const run = (...args) => execFileSync('git', args, { cwd: repo, encoding: 'utf8', timeout: 30_000 });
+  const run = (...args) => execFileSync('git', args, { cwd: repo, encoding: 'utf8', timeout: FRESH_FIXTURE_GIT_TIMEOUT_MS });
 
   run('init', '--quiet', '-b', 'main');
   run('config', 'user.email', 'test@example.invalid');
@@ -2050,7 +2100,7 @@ test('property: reported added/dropped are exactly the set differences', () => {
 // the working-tree fixtures, which would be whatever this PR's author regenerated;
 // comparing against those would be vacuous.
 
-test('differential attribution over the real tree', { timeout: 480_000 }, async (t) => {
+test('differential attribution over the real tree', { timeout: HEAVY_REAL_TREE_TEST_TIMEOUT_MS }, async (t) => {
   if (process.platform === 'win32') {
     // Mirrors the golden harness: install output is platform-specific on Windows
     // (backslash paths), so parity is asserted on macOS + Linux. An explicit t.skip,
@@ -2062,7 +2112,7 @@ test('differential attribution over the real tree', { timeout: 480_000 }, async
   // hooks/dist is gitignored and built (DEFECT.HOOKS-DIST-SCOPED-CI): the scoped CI
   // lane does not run build:hooks, so a real install there would emit no hooks/ dir.
   // Build idempotently, exactly as the golden harness does.
-  execFileSync(process.execPath, [BUILD_SCRIPT], { encoding: 'utf-8', stdio: 'pipe', timeout: 120_000 });
+  execFileSync(process.execPath, [BUILD_SCRIPT], { encoding: 'utf-8', stdio: 'pipe', timeout: BUILD_HOOKS_UNDER_LOAD_TIMEOUT_MS });
 
   // The base ref is not universally available. The gsd-test runner shallow-clones and
   // merges base+head, so no `origin/*` remote-tracking ref exists in the container —