feat(#3274): make reviewer-lane timeout configurable via timeoutConfigKey (#4083)

* feat(#3274): make reviewer-lane timeout configurable via timeoutConfigKey

Add an optional `timeoutConfigKey` field to the reviewer lane descriptor,
resolved in `resolveLanePlan` at invocation time and falling back to the
frozen `timeoutFloorMs` when unset or invalid, in the same spirit as the
existing `promptBudgetKey`/`modelConfigKey` fields. All 12 shipped lanes
declare `review.timeouts.<slug>` on both surfaces (the descriptor and their
capability.json manifest), validated by capability-validator.cjs.

For the antigravity lane, the native `agy --print-timeout` flag — previously
a second hardcoded literal (`540s`) independent of the outer cap — is now
derived from the same resolved outer timeout in `antigravityArgv`, preserving
the existing 60-second buffer relationship (ADR-2782 D6: the outer bound is
declared data, the inner one is handler-owned).

The antigravity default timeoutFloorMs stays at 600s per the maintainer's
disposition; users raise it through the new config key instead.

* docs(#3274): document review.timeouts.* and extract resolveTimeoutMs helper

Address code-review findings on the timeoutConfigKey change: extract the
inline timeout-resolution logic into a named, exported, directly-tested
resolveTimeoutMs helper (matching the file's existing configString/
normalizeHost convention); document the new review.timeouts.* federated
config keys in docs/CONFIGURATION.md, docs/reference/capability-manifest.md,
and docs/how-to/ship-a-reviewer-lane.md; add the changeset fragment.

* fix(#3274): resolve native antigravity timeout in resolveLanePlan, not the runner

gsd-test caught two design mistakes in the prior commits:

1. SpawnPlan.argv is documented and tested as fully resolved by
   resolveLanePlan (model/effort/output/prompt already folded in) — leaving
   the antigravity '{{nativeTimeout}}' marker unresolved until the runner's
   antigravityArgv violated that contract and broke tests that read
   plan.argv directly (tests/antigravity-reviewer.test.cjs,
   tests/review-default-reviewers-workflow.test.cjs). Fix: '{{nativeTimeout}}'
   is now a fifth ARGV_PLACEHOLDER member, resolved by resolveLanePlan itself
   via the new nativeTimeoutToken() helper, exactly like the other four.
   antigravityArgv reverts to its pre-#3274 four-argument form. Also missed
   updating capabilities/antigravity/capability.json's invoke.args to match
   the descriptor, which broke the manifest/descriptor parity test.

2. tests/reviewer-config-federation.test.cjs enforces a deliberate, narrow
   invariant (#3691 narrows #2797): qwen, cursor, and coderabbit — the three
   lanes with neither a model flag nor a host — may own no config key beyond
   their own prompt-budget key. Adding review.timeouts.<slug> to all 12 lanes
   violated it. Fix: those three keep timeoutConfigKey: null and own no
   review.timeouts.* key, matching their existing modelConfigKey: null. The
   other 9 lanes are unaffected.

* chore(#3274): backfill changeset PR number (pr:0 -> 4083)

---------

Co-authored-by: sim <sim@local>

docs/CONFIGURATION.md

@@ -276,6 +276,22 @@ The same applies to `review.max_prompt_tokens_per_reviewer.<slug>`. `review.max_
 (the global default), `review.default_reviewers` and `review.reviewer_instances` describe policy
 across lanes rather than one lane's behavior, so they remain central and are unaffected.
 
+### Reviewer lane timeouts (`review.timeouts.*`, #3274)
+
+Nine of the twelve declared reviewer lanes accept an outer wall-clock timeout override, federated
+per-lane exactly like `review.max_prompt_tokens_per_reviewer.<slug>` above — the key is owned by
+that lane's own capability manifest, not a central schema. Keys are seconds: `review.timeouts.gemini`,
+`review.timeouts.claude`, `review.timeouts.codex`, `review.timeouts.opencode`,
+`review.timeouts.antigravity`, `review.timeouts.kimi-code`, `review.timeouts.ollama`,
+`review.timeouts.lm_studio`, `review.timeouts.llama_cpp`. Unset (or `0`/negative/non-numeric)
+falls back to that lane's built-in floor. For the `antigravity` lane specifically, this value also
+derives its native `agy --print-timeout` flag (roughly 60 seconds under the configured outer
+value), so raising `review.timeouts.antigravity` raises both bounds together — this is how to fix
+a reviewer lane being killed mid-run on a large plan set: `gsd config-set review.timeouts.antigravity 900`.
+Three lanes — `qwen`, `cursor`, and `coderabbit` — take neither a model flag nor a host and do not
+federate a timeout key either, matching the same narrow key-ownership invariant their
+`review.models.*`/host keys already follow (each owns only its own prompt-budget key).
+
 ### Reviewer defaults for `/gsd-review`
 
 Use `review.default_reviewers` to scope the no-flag `/gsd-review` run to a subset of detected reviewers.