feat(core): centralize run_with_timeout buckets, annotate eval/SAFE

Two safety contracts that were previously implicit are now explicit.

Timeouts: lib/core/timeouts.sh defines six semantic buckets (QUICK_DETECT,
SHORT_QUERY, MEDIUM_PROBE, PKG_LIST, PKG_CLEANUP, DISK_VERIFY) with
rationale, all overridable via env. 19 hardcoded run_with_timeout values
migrate to these constants. 14 sites stay literal where the value
(1s / 8s / 15s / 0.2s) does not fit a bucket; the file header documents
why and each site gets an inline "Ns: <why>" comment so the magic number
is self-explaining.

Eval: every `eval` in lib/ now carries a "# eval: <why>" comment on the
preceding line, naming the indirection it provides (bash 3.2 has no
nameref, shopt state restore, trap restore). Future contributors can
audit the call sites without re-deriving why eval is acceptable here.

# SAFE: the two raw `rm -rf` call sites in lib/ (apps.sh stub-only
container, base.sh temp-file cleanup) carry inline "# SAFE: <reason>"
annotations that the .github/workflows/test.yml security job greps for.

bin/uninstall.sh: mdls display-name probe now uses
$MOLE_UNINSTALL_INLINE_MDLS_DISPLAY_TIMEOUT_SEC instead of a hardcoded
0.04s, matching the existing kMDItemLastUsedDate timeout env var.