Abort stalled GraphQL invocations after a configurable timeout

[morluto]

Fixes #1414

Summary

• Apply a 110-second default timeout to the complete GraphQL upstream invocation, including response body decoding.
• Allow plugin callers to override the deadline with invokeOptions.timeoutMs.
• Return GraphqlInvocationError with reason: "invocation_timeout" to direct SDK callers and graphql_request_timeout to tool callers.
• Add a regression test that proves timeout interruption closes a real upstream socket.
• Add an executor patch changeset.

Why

The GraphQL transport previously waited without an application-level deadline. An upstream could send successful response headers and an incomplete JSON body, leaving the tool call pending until an external limit ended it.

GraphQL responses are decoded before the tool returns, so the timeout covers the full body read. This differs from the OpenAPI streaming path, where a timeout ends after response headers so a valid stream can remain open.

Regression proof

On origin/main, the new test reaches its independent one-second guard because the invocation is still pending, with an observed elapsed time of about 1,015 ms.

With this change and a 100 ms test timeout, the tool returns graphql_request_timeout around the configured deadline and the test observes the TCP socket closing.

Compatibility

invokeOptions is optional, so existing plugin construction and direct invocation call sites remain source-compatible. Calls that complete within 110 seconds retain their current behavior. Calls that exceed the deadline now fail explicitly instead of waiting for an external limit.

Validation

• bun run test -- src/sdk/invocation-timeout.test.ts src/sdk/plugin.test.ts: 2 files and 34 tests passed.
• bun run typecheck: passed with pre-existing Effect language-service suggestions.
• Targeted lint and formatting checks passed for all 6 changed files.
• git diff --check passed.
• Branch autoreview against origin/main returned no actionable findings.

Review order

1. packages/plugins/graphql/src/sdk/invoke.ts, timeout boundary and cancellation behavior.
2. packages/plugins/graphql/src/sdk/plugin.ts and errors.ts, option plumbing and failure mapping.
3. packages/plugins/graphql/src/sdk/invocation-timeout.test.ts, real-socket regression proof.