E2E refresh-models bootstrap kill is shorter than Official native-cache wait

[NOirBRight]

What happened

Isolated Windows -CliOnly on 0de868d9 failed before any of the eight CLI cases:

• failure_classification: candidate_gateway_bootstrap_timeout
• duration_ms: 29916
• Official snapshot publication_ready = false
• Catalog contained only third-party glm-5.2, not gpt-5.6-luna

Live GUI on C:\CodexHub:9099 was not involved. Candidate uses isolated port 19191.

Why

refresh-models waits up to 8s for Codex model/list plus 20s native models_cache.json grace (src-tauri/src/models.rs). The E2E runner kills that process at min(TimeoutSeconds, 30) (Invoke-CandidateOfficialBootstrap). Live default -TimeoutSeconds is 180, so the cap is 30s.

The runner retries native-cache timeout only if the process exits with that error. A 30s kill sets timed_out and skips retry. Cold isolated CODEX_HOME (skills/sqlite) sits in front of the 8+20s wait.

Acceptance

• E2E bootstrap kill budget is a named constant 120s (or the smaller -TimeoutSeconds).
• Product 8s/20s Official waits stay unchanged.
• Listener/health remain a separate 30s window after bootstrap returns.
• Synthetic test: refresh-models hang ~32s then succeed must pass with -TimeoutSeconds 60 (fails today).
• Over-budget hang still fail-closed as candidate_gateway_bootstrap_timeout.
• Existing retry and 5s shared-listener synthetic tests still pass.
• Live -CliOnly 8/8 with a new output root; do not copy ~/.codex.

Out of scope

#149 lock protocol, telemetry disable, GUI matrix, GitHub Latest, shrinking in-app cache grace.

[NOirBRight]

Harness fix on the worker branch: CandidateOfficialBootstrapBudgetSeconds = 120 (min(-TimeoutSeconds, 120)). Product 8s/20s waits unchanged. Synthetic: hang past 30s now passes with -TimeoutSeconds 60; over-budget hang still candidate_gateway_bootstrap_timeout; retry + 5s listener tests still pass.