fix(cli): a deadline is not a changed repository

[rldyourmnd]

gds module update-pin --apply re-runs the module's required lanes inside its precondition observer. For the GDS module that takes over two minutes, and the CLI default was 2m0s for every command — so the deadline fired mid-observation and the engine reported the only thing it could see:

GDS_STALE_PLAN — Repository "repo_…" changed before its first mutation step;
                 its action handler was not called.

Nothing had changed.

attempt	flag	result	wall
1–3	default	blocked GDS_STALE_PLAN	2m00.158s
4	--timeout 20m	succeeded, gitlink staged	2m27s

The plan's own worktree_fingerprint was byte-identical across consecutive plans and gds status was byte-identical before and after planning, so the state genuinely did not move. That message sends the reader looking for a concurrent writer that does not exist, which is worse than a plain failure.

Two changes

Commands that execute another repository's verification lanes default to twenty minutes. update-pin runs them twice — once to plan at the target commit, once when the engine re-observes preconditions before mutating. An explicit --timeout still wins: a caller choosing a deadline is a decision, not an oversight.

An expired context is named. Any command whose deadline fires while failing now carries GDS_COMMAND_DEADLINE_EXCEEDED alongside whatever the interrupted step reported, with the deadline and the flag that sets it in its evidence.

Proof

Three tests — the expired deadline is named and states what it is not, a successful command near its deadline is not labelled with one, and the lane default applies only when the caller did not choose. All three fail with either half reverted, checked by reverting each.

go test ./... and scripts/validate_ci_tier.sh pr-required pass; projections are current.

Closes #57.

https://claude.ai/code/session_01BjpW1NtF1oik18aEMMGtMP