test(cli): restore CI timeout headroom and lock-suite quarantine lost in packages/cli split

The packages/cli move (dc97ab49, Jul 26) forked vitest.config.ts and the test
script off main before three since-merged CI-stability fixes existed there,
and #921's later "port upstream fixes" pass (f3f5814b) missed all three since
it only cross-referenced one specific main commit:

- 30037b33: global vitest testTimeout raised from the 5s default to 30s
  (real-I/O tests exceed 5s under CI runner load)
- 8c758ddf: file-level 30s timeout on cli-status-menubar.test.ts (spawns the
  real CLI; individual cases observed needing 6-8s on a shared 2-core runner)
- 4ca2d482: cache-refresh-lock tests excluded from the parallel `test` run and
  quarantined behind a serial `test:locks` script (they contend for the fork
  pool with the spawned-subprocess tests and starve everyone under load)

None of this showed up until #923 wired `npm test --workspace=codeburn` into
CI for the first time, which then failed deterministically at the vitest
default 5000ms on exactly the three test categories these fixes cover.

Ports all three, matching main's current config/script.

packages/cli/package.json

@@ -16,7 +16,8 @@
     "build:cli": "tsup && node -e \"const fs=require('fs'); fs.copyFileSync('src/cli.ts','dist/cli.js'); fs.chmodSync('dist/cli.js',0o755)\"",
     "build:dash": "cd ../../dash && npm install --no-audit --no-fund --silent && npm run build",
     "dev": "NODE_OPTIONS=--no-deprecation tsx src/cli.ts",
-    "test": "vitest",
+    "test": "vitest run tests --exclude \"tests/cache-refresh-lock*\"",
+    "test:locks": "vitest run tests/cache-refresh-lock.test.ts tests/cache-refresh-lock-process.test.ts --poolOptions.forks.singleFork=true",
     "prepublishOnly": "npm run build"
   },
   "keywords": [

packages/cli/tests/cli-status-menubar.test.ts

@@ -3,7 +3,12 @@ import { tmpdir } from 'node:os'
 import { delimiter as pathDelimiter, join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+
+// Every case here spawns the real CLI and does genuine multi-provider parse
+// work; the 5s default is fine on a dev laptop and not on a shared 2-core
+// runner, where individual cases have been observed needing 6-8s.
+vi.setConfig({ testTimeout: 30_000 })
 
 function runCli(args: string[], home: string, extraEnv: Record<string, string | undefined> = {}) {
   return spawnSync(process.execPath, ['--import', 'tsx', 'src/cli.ts', ...args], {

packages/cli/vitest.config.ts

@@ -6,6 +6,9 @@ export default defineConfig({
     // session-discovery env vars (CLAUDE_CONFIG_DIRS, HOME, XDG_*, every
     // provider-specific *_HOME) don't bleed real local data into fixtures.
     setupFiles: ['./tests/setup/env-isolation.ts'],
+    // Real-I/O tests (session parses, sqlite fixtures, worker pools) exceed the
+    // 5s default under CI runner load; a hung test still fails at 30s.
+    testTimeout: 30_000,
     // A handful of integration tests exercise real servers, spawned CLI
     // subprocesses and real filesystem locks. Under a saturated full-suite run
     // an fs/socket op can starve and the operation fails closed (correct, but