fix(ci): per-package timing files, acp flake timeout, 4040-guard marker

- ci-test-shard: timing outputFile is now RELATIVE — one pnpm invocation
  fans out to several packages whose vitests all received the same
  absolute path, so every package overwrote the same timings file (last
  writer wins). Each package now writes <pkgDir>/.timings/; discovery
  (discoverWorkspaceTimingFiles) and the CI artifact globs scan the tree
- acp event-bridge-bounds: 20s timeout on the CPU-bound plan-flood test
  (timed out at default 5s under loaded CI shard, passes in isolation)
- acp process-manager: port-4040-allowlist marker for its doc comments
  (main-side; local guard flagged it after merging main)

.github/workflows/pr-checks.yml

@@ -96,7 +96,13 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: test-timings-shard-${{ matrix.shard }}
-          path: .timings/timings-*.json
+          # Relative outputFile paths mean each package writes its own
+          # <pkgDir>/.timings/ file — glob the whole tree, not just the root.
+          path: |
+            .timings/timings-*.json
+            packages/*/.timings/timings-*.json
+            plugins/*/.timings/timings-*.json
+            plugins/examples/*/.timings/timings-*.json
           if-no-files-found: ignore
           retention-days: 14