fix(core): address PR review on retry defaults and timeouts

Align provider maxRetries default with pi (0), treat maxRetryDelayMs 0 as
no cap, keep per-attempt timeout through stream reads, and fix gitleaks
test fixtures.

.gitleaks.toml

@@ -8,6 +8,7 @@ title = "pi-commandcode-provider secret scan"
   paths = [
     # Test helpers with mock credentials
     "tests/test-oauth.ts",
+    "tests/test-retry.ts",
     "tests/test-stream.ts",
     "tests/test-pure-functions.ts",
     "tests/test-pi-local.mjs",