fix(core): cap provider retry-after delays at fifteen minutes - #45787

Summary

• Session retries take the larger of the scheduled backoff and a provider-requested retry-after delay. That minimum was unbounded, so a buggy or hostile retry-after header (for example one hour) silently stalled the session for that entire duration.
• Cap the provider-requested minimum at fifteen minutes before it raises the scheduled delay. Ordinary backoff behavior is unchanged, and requested delays at or below the cap are still honored exactly.

Verification

• New runner test: a 60-minute retryAfterMs waits exactly fifteen minutes before the next attempt.
• bun run test test/session-runner.test.ts: 174 pass, 0 fail.
• bun typecheck passes in packages/core; formatting and diff checks pass.