fix(doctor): add timeouts to git network operations to prevent hanging

The CloneDivergenceCheck was running `git fetch --quiet` without any
timeout, causing `gt doctor` to hang indefinitely when any git clone
had network issues, SSH key prompts, or credential dialogs.

Added timeouts to potentially blocking network operations:
- git fetch --quiet: 5 second timeout
- git pull --rebase: 30 second timeout

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/doctor/branch_check.go

@@ -1,11 +1,13 @@
 package doctor
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 )
 
 // BranchCheck detects persistent roles (crew, witness, refinery) that are
@@ -103,13 +105,16 @@ func (c *BranchCheck) Fix(ctx *CheckContext) error {
 			continue
 		}
 
-		// git pull --rebase
-		cmd = exec.Command("git", "pull", "--rebase")
+		// git pull --rebase (with timeout to prevent hanging on network issues)
+		pullCtx, pullCancel := context.WithTimeout(context.Background(), 30*time.Second)
+		cmd = exec.CommandContext(pullCtx, "git", "pull", "--rebase")
 		cmd.Dir = dir
 		if err := cmd.Run(); err != nil {
 			// Pull failure is not fatal, just warn
+			pullCancel()
 			continue
 		}
+		pullCancel()
 	}
 
 	return lastErr
@@ -527,7 +532,15 @@ func (c *CloneDivergenceCheck) getCloneInfo(path string) (cloneInfo, error) {
 	}
 	info.headSHA = strings.TrimSpace(string(out))
 
-	// Count commits behind origin/main (uses existing refs, may be stale)
+	// Fetch to make sure we have latest refs (silent, ignore errors)
+	// Use a short timeout to prevent hanging on network issues, SSH prompts, or credential dialogs
+	fetchCtx, fetchCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer fetchCancel()
+	cmd = exec.CommandContext(fetchCtx, "git", "fetch", "--quiet")
+	cmd.Dir = path
+	_ = cmd.Run()
+
+	// Count commits behind origin/main
 	cmd = exec.Command("git", "rev-list", "--count", "HEAD..origin/main")
 	cmd.Dir = path
 	out, err = cmd.Output()