#2307 refactor: share daemon command and teardown budgets

Summary

Shares request timeout calculation through the existing command policy module. The client resolves registry policy and calculates its envelope synchronously from neutral inputs, making the same calculation available to managed admission.

Ordinary teardown requires an existing session; managed recording reservation belongs to #2308. Arithmetic, cleanup behavior, and ordinary/provider behavior are preserved.

Twelve files: eleven within timing/teardown, plus one fixture correction in a separate commit. That fixture intercepts session prewarm before its deferred runner import. Tests move beside their owners and reuse session fixtures. No standalone docs or skills changed for this internal refactor.

Validation

Rebased onto requested main snapshot 80997b6bf1dda30ca57d74dc42036f6b447e16ad. All four commits are unchanged by range-diff from the previously reviewed head; there were no conflicts. Tested head: 97f4e7057f3c4d6dead9df39a6a7645063c877e4.

• Fresh exact-head pnpm check:affected --run passed: 3,227 tests / 429 files. The focused suite passed 482 tests, including all 418 eager-closure checks against the exact main snapshot. Host-wide gate serialization was used.
• Existing red/green evidence is preserved: removing positional margin fails at 180000 versus 210000; the overlapping-import probe reproduces forbidden runner startup cleanup before the fixture fix and passes afterward. Its single-import negative control passes. No diagnostic instrumentation or guard changes remain.
• Independent adversarial review of the final restack is READY: no actionable findings.

Prior iOS attempts failed before device smoke in toolchain preparation. Replacement-head Coverage, Integration, and native checks will be rechecked against this main snapshot; its smoke fixes are not assumed to pass.