fix(launcher): raise developer/reviewer timeout budgets + stamp model at launch

Two additive, isolated launch-subsystem fixes from incident ORCH-104, without
touching STAGE_TRANSITIONS / QG_CHECKS / check_* / machine-verdict / DB schema.

D1 — launch-time model stamp: write the resolved model into agent_runs.model in
the SAME UPDATE as the effort stamp (ORCH-087), so the model is present from
launch, survives a timeout-kill (exit_code=-9), and is visible in-flight in
/metrics & /queue. record_usage stays an enrichment (model=COALESCE preserves the
launch stamp when the usage JSON model is None). never-raise (isolated try/except).

D3/D4 — dedicated per-role budgets: agent_timeout_developer_s=3600 /
agent_timeout_reviewer_s=3000 with a deterministic _resolve_timeout ladder
(overrides_json[agent] > dedicated role key > agent_timeout_seconds=1800; other
roles byte-for-byte). Malformed/non-positive config falls back to the global
default + WARNING (never-break). reaper_max_running_s raised 3600 -> 5400 in
lockstep to keep the ORCH-065 invariant (5400 > 3600 + 20 = 3620).

FR-4 (kill / in-flight visibility) and FR-5 (anti-salvage) are structural in the
existing code; pinned here by regression tests (tests/test_orch109_timeout_model.py,
TC-01..TC-12). Docs: .env.example, config passport, CHANGELOG, CLAUDE.md
(README/internals authored by architect in this branch).

Refs: ORCH-109

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.py

@@ -120,10 +120,28 @@ class Settings(BaseSettings):
     #                            (env ORCH_AGENT_KILL_GRACE_SECONDS).
     # agent_timeout_overrides_json -> optional per-agent override JSON object,
     #                            e.g. {"reviewer": 3600, "architect": 2700}
-    #                            (env ORCH_AGENT_TIMEOUT_OVERRIDES_JSON).
+    #                            (env ORCH_AGENT_TIMEOUT_OVERRIDES_JSON). HIGHEST
+    #                            priority escape-hatch in _resolve_timeout (wins for
+    #                            any role).
+    # ORCH-109 (D3/D4): raised wall-clock budgets for the two HEAVY roles.
+    #   agent_timeout_developer_s -> developer is the bottleneck (effort xhigh,
+    #                            coding/agentic); 3600s/60m (env
+    #                            ORCH_AGENT_TIMEOUT_DEVELOPER_S).
+    #   agent_timeout_reviewer_s  -> reviewer reads a large diff + writes the review
+    #                            (high reasoning); 3000s/50m (env
+    #                            ORCH_AGENT_TIMEOUT_REVIEWER_S).
+    # _resolve_timeout ladder: overrides_json[agent] > dedicated role key >
+    # agent_timeout_seconds (other roles stay at 1800, byte-for-byte). A malformed
+    # JSON / non-positive dedicated value falls back to agent_timeout_seconds +
+    # WARNING (never-break). The defaults ARE the prod budget (ORCH-101 canon: empty
+    # .env reproduces prod). CROSS-INVARIANT (ORCH-065): reaper_max_running_s MUST
+    # stay > max(resolved timeout) + agent_kill_grace_seconds; raised in lockstep to
+    # 5400 below (5400 > 3600 + 20 = 3620).
     agent_timeout_seconds: int = 1800
     agent_kill_grace_seconds: int = 20
     agent_timeout_overrides_json: str = ""
+    agent_timeout_developer_s: int = 3600
+    agent_timeout_reviewer_s: int = 3000
 
     # ORCH-41: per-agent LLM model. Empty -> agent_model_default. Resolution order:
     # project-override (projects_json agent_models) > ORCH_AGENT_MODEL_<AGENT> >
@@ -480,6 +498,9 @@ class Settings(BaseSettings):
     #   reaper_max_running_s  -> Tier-3 backstop ceiling: a job 'running' longer than
     #                           this is reaped even when liveness is unknowable. MUST be
     #                           > max agent_timeout + grace so a legit agent is safe.
+    #                           ORCH-109 (D4): raised 3600 -> 5400 in lockstep with the
+    #                           developer budget (5400 > 3600 + 20 = 3620; headroom 1780s
+    #                           also covers the monitor finalization window).
     #   reaper_finalize_grace_s -> Tier-2 anti-false-positive: a LIVE monitor writes
     #                           agent_runs.exit_code FIRST, THEN does git commit/push +
     #                           PR + Plane usage comments (seconds..minutes) and only
@@ -494,7 +515,7 @@ class Settings(BaseSettings):
     reaper_enabled: bool = True
     reaper_interval_s: int = 60
     reaper_dead_ticks: int = 2
-    reaper_max_running_s: int = 3600
+    reaper_max_running_s: int = 5400
     reaper_finalize_grace_s: int = 300
     lease_reclaim_enabled: bool = True