opencode-route-proxy: per-leg first-response timeout — shed transport-timeout legs inside the client window (#4370 acceptance (b))

Implementation slice scoped by triage task 8950 (lane W, 2026-11-04) extending #3325 leg-shedding to the #4370 death classes. Findings and full evidence are on #3325 (task 8950 comment) and #4370.

Problem (verified at main, blob 70f01618, bin/opencode-route-proxy.mjs, 1095 lines)

• callLeaf's fetch passes only the shared walk signal — there is no per-leg timeout. A hung/slow leg holds the walk; the only cap is the whole-walk TIMEOUT_MS (line 62, default 1,200,000 ms).
• runCompletion does fall through on per-leaf transport errors, but only while the signal is not aborted; the OpenCode client's ~10 s no-output window (provider.transport "No response output within 10000ms", fleet session deaths rotated legs: provider.transport timeouts on the gpt-6-luna leg and cline-pass leg wall/rate-limit deaths are not tracked by #3325 #4370) kills the session first, and a client abort is terminal in the walk.
• Net effect: a transport-timeout leg is never shed in time — ~30 fleet sessions died this way on 2026-11-01 (fleet session deaths rotated legs: provider.transport timeouts on the gpt-6-luna leg and cline-pass leg wall/rate-limit deaths are not tracked by #3325 #4370).

Scope

• Per-leaf first-response (headers) timeout in bin/opencode-route-proxy.mjs, configurable via env in the existing OPENCODE_ROUTE_PROXY_* pattern, sized well under the client no-output window; on timeout, record the attempt (outcome timeout, tag Transport, failedOverTo set) and continue the walk.
• Proxy tests: hung first leg sheds to a live second leg inside the timeout; ledger row written.
• Verify whether the client's ~10 s provider.transport window is configurable for proxied routes; if the proxy-side fix cannot beat it, record that on fleet session deaths rotated legs: provider.transport timeouts on the gpt-6-luna leg and cline-pass leg wall/rate-limit deaths are not tracked by #3325 #4370 with the exact client setting named.

Out of scope: in-stream pre-content error shedding (task 8932, #3325), mid-stream fallthrough, route redesign.

Acceptance criteria

• A transport-timeout leg is shed like a quota-exhausted leg: walk continues, session completes on a live leg.
• Per-leg timeout configurable + documented next to TIMEOUT_MS; responding legs unchanged.
• fleet session deaths rotated legs: provider.transport timeouts on the gpt-6-luna leg and cline-pass leg wall/rate-limit deaths are not tracked by #3325 #4370 acceptance (b) satisfied by the merged fix, or closed out on fleet session deaths rotated legs: provider.transport timeouts on the gpt-6-luna leg and cline-pass leg wall/rate-limit deaths are not tracked by #3325 #4370 with provider/client-side evidence.

Refs: #4370 (acceptance (b)), #3325, task 8950, task 7380.