fix(ai): scale triage timeout and report build versions

[alxxjohn]

Summary

• scale the default AI triage timeout from a fixed 20s to 60s plus 3s per additional candidate, capped at 180s, while preserving explicit CODEGUARD_AI_TRIAGE_TIMEOUT overrides
• make deadline failures actionable and non-retryable, preserving static findings and the scan result
• report Anthropic max_tokens and OpenAI length responses as truncation errors instead of invalid JSON
• resolve codeguard version from Go build info for go install builds, with VCS-derived development versions for local source builds and linker injection retaining precedence
• isolate three offline tests from ambient provider credentials

Root causes

Triage used one constant whole-request client timeout even though each request includes every pending finding and non-streaming providers return headers only after generation. Version reporting relied exclusively on linker flags, which go install module@version does not supply even though the module version is embedded in Go build info.

Validation

• make fmt
• make lint-strict — 0 issues
• make test
• make codeguard-ci — 0 fail findings
• make check
• go install ./cmd/codeguard && codeguard version — reported 0.1.0-dev+<revision>
• linker precedence build — reported injected v9.9.9

Provider keys were removed for all gates. Anthropic's official model documentation confirms claude-sonnet-4-6 is a valid dateless API model ID, so the default model was left unchanged.

[alxxjohn]

Fixed the Homebrew validation failure in ed71e23. The workflow now reads the compiled defaultNumber through scripts/version-from-source.sh, with a regression test under tests/version. All local gates pass, including make lint-strict with 0 issues and make codeguard-ci with 0 fail findings.