test: bound exhaustive credential invariant timeout

[andrei-hasna]

Summary

• give the exhaustive database credential invariant an explicit 30-second per-test timeout
• keep every other Shield test, including the safe-noncredential control, on Bun's default timeout

Evidence

• RED before the change: 9 pass, 1 fail, 6000 expect() calls; exhaustive invariant timed out after 5000ms
• focused file: 10 pass, 0 fail, 6000 expect() calls
• exhaustive invariant only: 1 pass, 0 fail, 864 expect() calls
• safe noncredential control only: 1 pass, 0 fail, 28 expect() calls
• full bun test --parallel=1: 439 pass, 0 fail, 7038 expect() calls
• bun run typecheck: pass
• strict OSS secrets policy: Violations: 0
• staged and commit-range gitleaks: no leaks found
• independent adversarial review: [REVIEW] GO, no in-scope P0/P1 findings

Todos: SHI-00003

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}