Context

PR #1630 adds audience-aware Git working-context snapshots for sessions and subagents. The provider boundary is reusable, but the concrete process execution is currently static and synchronous.

Problem

• Git process behavior cannot be faked directly, so timeout, process termination, stderr sanitization, output bounding, and non-repository classification lack deterministic command-runner tests.
• rev-parse and status each receive an independent timeout rather than sharing one aggregate snapshot deadline. This does not match the intended strictly bounded snapshot contract.
• A synchronous inspection blocks the session actor mailbox while Git runs. Any design change should keep actor responsiveness explicit without introducing timeout jiggling or sleep-based tests.

Proposed scope

Introduce a small internal Git command-runner abstraction beneath IWorkingContextSnapshotProvider. Keep parsing and rendering pure. Enforce one deadline across all commands needed for a snapshot and inject TimeProvider where elapsed-time behavior is tested. Avoid creating a generalized Git framework.

Acceptance criteria

• Git command execution can be replaced with a deterministic fake in tests.
• One aggregate deadline covers repository-root discovery, status inspection, and output collection.
• Deadline expiry terminates the child process tree and returns a sanitized unavailable result.
• Tests cover timeout, output overflow/bounding, missing Git, non-repository response, malformed output, and stderr sanitization without sleeps or real-time timeout tuning.
• Public-audience snapshots still short-circuit without invoking Git.
• Existing linked-worktree, branch, HEAD, dirty-count, and subagent handoff behavior remains unchanged.

Follow-up to #1630 and #1621.