fix(lfs): extend GitHub token refresh buffer + add LFS fetch timeout

[jrobotham-square]

Problem

LFS snapshot jobs have been failing with repeated Bad credentials from the
GitHub LFS batch API. Individual jobs have been observed running for 12–26
hours before something finally killed them:

git lfs fetch: Fetching reference refs/heads/main
batch response: Bad credentials
batch response: Bad credentials
... x6
error: failed to fetch some objects from '.../info/lfs'
: exit status 2, elapsed=25h58m40s

Root cause

GitHub App installation tokens have a fixed 1 h server-side TTL (not
configurable). The TokenManager cache served tokens until they had only
RefreshBuffer = 5m of validity remaining. That meant an LFS fetch starting
near a cache boundary could be handed a token with as little as ~5 minutes of
life left. If the fetch ran longer than that, the token expired mid-flight.
git-lfs's batch endpoint then retried with the same expired token (it's
baked into credential.helper as a literal), turning every retry into a 401,
and there was no per-subprocess timeout to stop the retry storm.

Fix

Two coordinated changes that make lfsFetchTimeout < RefreshBuffer an
airtight invariant:

1. internal/githubapp/config.go — bump RefreshBuffer from 5m to
   30m. Every token handed out now has at least 30 m of validity remaining.

2. internal/strategy/git/snapshot.go — wrap git lfs fetch in
   context.WithTimeout(ctx, 25*time.Minute). Bounds the retry-storm
   runaway and guarantees no subprocess can outlive the token baked into
   its environment.

The 25 m < 30 m invariant is the airtight piece: the longest possible LFS
subprocess is shorter than the minimum remaining validity of any token it
could be handed, so a "Bad credentials" from token expiry should now be
impossible by construction on the LFS path.

Why not a refresh-mid-subprocess approach?

That alternative (file-backed credential helper + background refresh
goroutine) is much more invasive — new shell-form helper, temp-file
lifecycle, refresh goroutine, symlink-safety, ~150 LOC + tests. It only
buys us coverage of subprocesses that legitimately run longer than 1 h,
which our metrics don't show.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d42735e155

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jrobotham-square]

Good catch — fixed in 1cb340a. Applied the same Setpgid + Cancel-with-syscall.Kill(-pid, SIGKILL) pattern the clone/fetch paths in manager.go already use, so the 25 m deadline reliably tears down git-lfs and its transfer helpers.