Hub upgrade timeout rule differs between the shell helper and the Go cscli runner #1807

What: .docker/cscli-hub-mirror.sh retries hub upgrade through the mirror on a timeout; the Go runner (backend/internal/crowdsec/cscli_run.go) retries installs/upgrades on network-failure text only.

Where: .docker/cscli-hub-mirror.sh (_hub_timed_out), backend/internal/crowdsec/cscli_run.go.

Evidence: #1798 review/QA (QA-5 and alignment notes). Behaviour differs only for a budget-exhausting upgrade.

Severity: low

Suggestion: Pick one rule and pin it in both test suites; update the 20 s vs 60 s restore-budget note in docs/troubleshooting/crowdsec.md at the same time.

Found in #1798.