fix(terminal): the advertised foreground cap must match the enforced one

[Kyzcreig]

I called this cosmetic. It isn't.

#575 made terminal.max_foreground_timeout a config key and routed enforcement through _foreground_max_timeout(). I left the schema's quoted cap frozen and deferred it as cosmetic.

Measured with the cap set to 3600 in config.yaml:

at IMPORT   -> constant: 600
schema BEFORE bridge:    600
enforced AFTER bridge:   3600
schema AFTER bridge:     600     ← the model is told 600

TERMINAL_SCHEMA is built at import; _ensure_terminal_env_bridged runs on first tool use — after import.

Why it actually matters

The description is the only thing the model reads when choosing a timeout. A schema that understates the cap silently holds the model to the old limit and makes the config key look inert even though enforcement honours it — the user raises the cap and nothing appears to change.

Drift the other way is worse: an overstated cap invites a timeout that then gets rejected.

Fix

• _timeout_param_description(cap) — one builder, used by both the schema literal and the refresh, so the two copies of the text can't drift.
• _refresh_terminal_schema_limits() — called from the bridge's finally, so even a partial or failed bridge leaves schema and enforcement agreeing.
• Mutates the dict in place. The registry holds a reference to that same object, so rebinding the name would leave the registered copy stale. A test asserts registry.get_entry("terminal").schema is TERMINAL_SCHEMA rather than trusting it.

Also: a pre-existing hermeticity bug

test_default_value_is_600 read the live FOREGROUND_MAX_TIMEOUT, so it failed on unmodified fork/main for anyone who had set the config key — the bridge exports the env var process-wide and it leaks into the test run.

Verified failing on a clean --detach fork/main worktree before touching it, so this is a real inherited bug, not something my diff caused. It now pops the variable and reloads to assert the actual default.

Tests — 6, RED-proven

Reverting to the frozen description turns 3 red. Covers a raised cap, a lowered cap, refresh-through-the-registry, the bridge end-to-end, and the finally path when the bridge raises.

E2E — the exact reproduction:

at import    -> schema: 600  | enforced: 600
after bridge -> schema: 3600 | enforced: 3600   AGREE

tests/tools -k terminal: 195 passed, 5 skipped, 0 failed.