Make external tool executables and operation timeouts configurable

Parent: #1230

## Problem

Graith assumes fixed executable names/paths such as `git`, `gh`, `sh`, `osascript`, `/bin/ps`, and `/usr/sbin/lsof`. Git fetch/merge/username operations also use fixed 2m/2m/15s timeouts.

This makes Nix/custom PATH setups, wrappers, alternate shells, and slower repositories difficult to support. Relevant code spans `internal/git`, `internal/store`, `internal/daemon/ghpr.go`, notification/resource-monitor code, and CLI store discovery.

## Acceptance criteria

- Add a documented tool-resolution configuration for overrideable external executables.
- Add typed timeouts for Git/GitHub operations that can legitimately vary by environment.
- Use the same resolved Git/GitHub tools in daemon, store, and CLI paths.
- Validate explicit paths at use/startup with actionable errors while retaining PATH lookup defaults.
- Keep semantic subcommands such as `git rev-parse` and sandbox backend protocol flags in code unless there is a concrete compatibility need; this is not a generic arbitrary-argv escape hatch.
- Add tests using fake tool binaries and non-default timeouts.

Start by tracing the fixed tool and timeout usage in internal/git, internal/store, internal/daemon/ghpr.go, notification/resource-monitor code, and CLI store discovery. Follow how Git and GitHub operations are shared across daemon, store, and CLI paths. Done means documented configuration, default PATH lookup, actionable validation, and tests with fake tool binaries and non-default timeouts.

Written by the indexing model from the issue text.