Fix /claude review/challenge: hard timeout + merge-base diff scope

[jackspacelb]

Problem

/claude review/challenge/consult had two compounding problems that made the
nested-Claude "outside voice" unreliable:

1. Unbounded run. The diff was piped into claude -p with no timeout and no
   size cap, so a large diff could hang effectively forever.
2. Wrong diff scope. The diff was captured with git diff origin/<base> —
   the working tree against the base tip. On a branch whose base has moved
   ahead, or whose base ref is stale/un-fetched, this balloons to hundreds of
   unrelated files. This is the deeper cause of "the review hangs": even with a
   timeout, the reviewer was handed a giant, mostly-irrelevant diff and produced
   nothing useful.

The sibling /codex skill already had timeout + exit-124 handling; /claude
never got it. (Both problems are still present on main, v1.56.0.0.)

Fix

Bound the run (commits 1–2):

• Wrap all four claude -p invocations (review, challenge, consult-new,
  consult-resume) in a hard timeout: gtimeout → timeout, 600s. Inlined
  per block on purpose — each bash block in a SKILL.md runs in its own shell, so
  a helper defined in another block would be undefined at call time.
• Prompt fed via < "$PROMPT_FILE" (not cat ... |), so timeout wraps
  claude directly. Deliberately not < /dev/null (would send an empty
  prompt).
• Fail closed if no timeout binary exists (exit 125 + clear "install
  coreutils" message) rather than silently running unbounded.
• On exit 124, state the run did NOT finish (do not treat as a pass) and print
  the first 120 lines of stderr before cleanup deletes it.

Scope the diff correctly (commit 3):

• Diff from the merge base to the working tree:
  git diff "$(git merge-base origin/<base> HEAD)". Shows only this branch's
  changes and keeps uncommitted work. (A plain three-dot diff would drop
  uncommitted changes, so merge-base → working tree is used instead.)
• Harden the base fetch: warn instead of silently diffing against a stale base.

Test

gen-skill-docs asserts the new stdin-redirect shape, timeout/124 + fail-closed
markers, and the merge-base diff scope; it rejects the old unbounded pipe and the
old base-tip diff, so neither can silently regress.

Verification

• Forced-timeout smoke (timeout 2 sleep 10) → exit 124, handler fires.
• Delivery smoke: claude -p ... < "$PROMPT_FILE" returns the exact prompt token
  (confirms the redirect delivers content, not an empty prompt).
• Diff-scope, empirically, on a branch whose base moved ahead: old git diff origin/main = 10 files of noise; merge-base diff = exactly the 2 real files.
• bun test test/gen-skill-docs.test.ts passes.

Left VERSION/CHANGELOG to maintainers. Not included (deliberately, as separate
concerns): a size-preflight/split path for legitimately huge diffs, and
fail-closed on all non-zero exits (only 124/125 are special-cased today).

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here