Bound the compaction summarizer and retry it once per failure class

[TheGreatAxios]

Summary

• The compaction summarizer now has its own per-call wall-clock cap (default 90 s, profile-configurable via summarizerTimeoutMs) instead of inheriting the director's 600 s totalTimeoutMs, and the harness's built-in retry policy is disabled for this call so the summarizer owns its retry budget.
• Exactly one retry per failure class: credential_failure/401/403 re-reads the OAuth token store (ensureFreshInferenceSource) and updates the live source before retrying; provider 5xx and Internal error during token generation retry once; timeouts and aborts are never retried.
• Final failure still throws so the compactor keeps prior context (the failed-summary record), and the TUI shows a one-line systemNotice naming the reason.
• Failures emit summarizer_failure telemetry with provider, model, error_kind (first-party enum), and duration_ms.

Verification

• bun run check lint, typecheck, and build pass; 17 summarizer tests pass including a virtual-clock test proving the 30 s cap fires while the harness default remains 600 s.
• The sandboxed test suite shows 45 unrelated EPERM failures (tests writing to /tmp or spawning git/processes); none touch the changed code.

Fixes CL-7694

[linear-code]

CL-7694

[TheGreatAxios]

Looks good to merge. Summarizer now owns a 90s per-call cap (well under the director 600s) with harness retries disabled, and retries at most once per failure class — auth/provider yes, timeout never, which is the right trade for an inline reactor freeze. Tests pin the independent timeout and the spent-budget 401 case. CI is green.