#3814 fix(timeouts): prove install request envelope

Summary

Fixes #3327. The install-family request envelope is now based on a worst-case ledger instead of only the longest subprocess timeout. The change touches 13 files, adds one provider integration ledger test, and carries bounded install timeouts through Android, iOS simulator, and install-source URL materialization. install, reinstall, and uninstall now use 330s; install-from-source and install_source use 420s because URL sources include the 120s download phase.

Validation

Tested SHA d0afa3038d45e632b63a383487e8ceb5ad63d508.

• pnpm check:affected --run --head d0afa3038d45e632b63a383487e8ceb5ad63d508: exactCommit=true; format, lint, typecheck, and layering passed; it stopped at Fallow because this Linux host lacks GLIBC_2.29/2.30 for @fallow-cli/linux-x64-gnu@3.34.0. Receipt: .tmp/validation/run-bbXxa2/receipt.json.
• pnpm build: passed.
• pnpm exec vitest run --project provider-integration test/integration/provider-scenarios/install-timeout-ledger.test.ts --reporter verbose: 5 passed.
• Focused unit-core timeout/deployment suites: 90 passed.

No live device run in this Linux container; CI remains authoritative for device lanes.