timeout-guard WriteableTmpDir.determine()

Add a timeout to WriteableTmpDir.determine()'s per-directory probe (utils/file.ts:97-101)
— wrap the writeFile/deleteFile pair in a bounded timeout (e.g. Promise.race against a 1-2s
cap) so one bad candidate can't block activation indefinitely; treat a timeout the same as any
other per-directory failure and move on to the next candidate.

Start in utils/file.ts at WriteableTmpDir.determine(), especially the per-directory probe at lines 97-101, and trace how writeFile and deleteFile failures advance to the next candidate. Bound that pair to the requested 1–2 second limit, treat expiry like other probe failures, and verify that activation continues when a candidate does not respond.

Written by the indexing model from the issue text.