feat(core): orchestrator hardening — per-provider timeout, retry, latencyMs, result cache

[MyPrototypeWhat]

Summary

Stacked on #7 (Wave 2 of the hardening plan; base auto-retargets to main when #7 merges).

• Resilience (on by default): each provider search gets a soft 10s timeout + 1 retry on 429/5xx/network errors (exponential equal-jitter backoff, abort-aware, discarded retry bodies drained for socket reuse). A hanging source is reported failed: timeout after Nms in meta while everyone else's results return. Tune via createRefkit({ resilience: { timeoutMs, retries } }) or disable with resilience: false. Zero-network invariant preserved (manual signal composition, no AbortSignal.any; injected fetch only).
• Observability: every fulfilled/failed provider status now carries latencyMs; the MCP explain output surfaces it (and cached) instead of zod silently stripping them.
• Cache: supplying a KeyValueCache now memoizes per-provider validated results (key refkit:v1:<provider>:<fnv1a(stableStringify(query))>, TTL cacheTtlMs default 5 min, deadline-bounded reads, any cache failure degrades to live search). Merge, rerank, and the license gate always run fresh — proven by a cached-proprietary-ref + gateFor regression test.

Test Plan

• pnpm -r typecheck — 20/20 packages clean
• pnpm test:run — 38 files, 282/282 (+23 over the Wave 1 baseline: resilience suite, timeout/retry/cache client tests, review-hardening locks)
• no-network.test.ts green (core still has zero fetch calls / endpoints)
• Review-verified: no double onProviderError on timeout, no unhandled rejections on any race path, plain-Error abort doesn't burn a retry, cache hits flow through the gate