Mitigate worker timeout starvation

[espadonne]

Summary

• bound lifecycle hard-delete work per stale repo/org so one stuck tombstone cannot consume the full sweep job
• make repo hard-delete rollback use a fresh short context after child timeouts
• prefilter code-search blobs by git-reported size before spawning cat-file, while preserving path indexing

Tests

• go test ./internal/worker/jobs ./internal/repos/git ./internal/repos/lifecycle
• go test ./internal/worker/... ./internal/repos/...
• make ci