fix(skills): charge only upstream waits to the install fetch budget

[owjs3901]

The release run for 0.13.0 failed once on Windows: skills_install::a_bare_workspace_reports_the_gap_and_one_call_closes_it found a skill installed with a reason that did not mention DEVUP_MCP_SKILLS_OFFLINE, although the test sets it. A re-run passed. The flake had a real cause in the product.

The cause

devup_skills install gives itself a four-second budget for fetching current documents from upstream. It was one deadline for the whole call, so the time spent writing each skill's files to disk counted against it too. On a slow disk - a Windows runner - the deadline passed while earlier skills were being written, and the later skills gave up before asking upstream, reporting "the four-second skill install fetch budget elapsed" and falling back to the embedded copy. With DEVUP_MCP_SKILLS_OFFLINE set that reason was simply wrong; online, it meant skills were never offered to upstream at all.

The README already promises what the fix does: "호출 전체의 네트워크 대기는 최대 4초입니다" - at most four seconds of network waiting per call.

What changes

• The budget is the time left for waiting on upstream, and only that waiting is taken from it. A fetch that answers at once costs nothing; one that stalls still stops the whole install at four seconds (the_entire_install_has_one_four_second_fetch_budget is unchanged and passes).
• New test time_spent_between_fetches_is_not_charged_to_the_fetch_budget: eight seconds pass outside any fetch, and the next skill still asks upstream and reports upstream's own answer. Against the old code it fails with Network("the four-second skill install fetch budget elapsed").
• skills_install's assertion now prints the offending entry, so a failure says which skill and why.
• Test hygiene: the bridge handover tests wait for the devup-mcp processes they start to exit before removing their scratch directories. Windows will not remove a directory a running process has as its current one, so every run left 3-4 directories in %TEMP%; now none.

Verification

• Windows: cargo test --workspace 120 suites, 1248 passed, 0 failed, 2 ignored; cargo clippy --workspace --all-targets --all-features -D warnings and cargo fmt --check clean. No devup-bridge-handover-* directory is left after the handover tests.
• Changepack: crates/devup-mcp/Cargo.toml Patch, 0.13.0 -> 0.13.1.