fix: bound the calls around a turn, and build packages in dependency order

[filipeforattini]

Two gaps left over from the five tranches, both found by the CI work in #108.

The calls around a turn had no bound

The inactivity watchdog from #103 reads a step handle. Two model calls have none:

• naming the session runs inside the turn loop before the step that produces the answer, so a
  small model that stops answering holds up the work the user actually asked for;
• compacting creates a processor of its own, which is not the handle the watchdog watches.

Both now give up and say so — naming after two minutes, compacting after ten, since compacting
reads the whole conversation back. Neither failure is the turn's failure: a session keeps its
default name, and a compaction that did not happen is reported as itself.
experimental.aux_timeout overrides both, false removes the bound.

Builds ran in arbitrary order

turbo.json declared "build": { "dependsOn": [] }, which does not mean "no extra dependencies" —
it replaces the topological default. The CLI build bundles the app, which imports sources the
SDK build generates, so with enough tasks in flight the two raced and the CLI build read
gen/types.gen.js before it existed. That is the failure that killed the first attempt at #108.

Verification

• Integration test seen failing first (with the bound removed the turn never finished) and passing
  after: a provider that never answers the naming request no longer delays the answer, and the
  session keeps its default name. Needed a new hangTitles control on the fake provider.
• Unit tests for the policy, including the default ordering and disabling.
• turbo build --dry confirms @reddb-io/redcode#build now waits for all eleven package builds it
  actually needs, sdk among them.
• bun typecheck across all 31 packages; packages/redcode session suite 444 pass, with three
  failures reproduced on unmodified sources on this machine (3 s and 60 s test timeouts under local
  load).

https://claude.ai/code/session_01U29Yk1UscZJ5ZVBXV1Sn8b

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}