Clamp SessionEnd hook timeout to Codex limit

[blakejgruber]

Codex clamps SessionEnd hook timeouts to three seconds, so the plugin's five-second declaration emits a warning whenever the plugin is loaded.

Set the declared timeout to the supported maximum and add a regression assertion that parses the manifest rather than matching text.

Validation:

• node --test tests/commands.test.mjs
• source and installed-cache manifests parse as JSON with SessionStart=5 and SessionEnd=3
• an ephemeral Codex session completed without the clamp warning

Tracked locally as RND-169.