fix(test): second review round — measurement integrity and hang budget

--update-durations now disables batching so every file is measured
per-file (batched members' entries otherwise rot), and only passing
runs record durations (a timed-out file would write the kill deadline
and permanently skew LPT).

Timed-out work items are no longer retried: the deadline already
proves a hang, and a second 600s attempt could push a shard past the
45-minute job budget.

A flaky batch now annotates the member files that failed the first
attempt instead of the pseudo-file. Defender exclusions apply per
path instead of aborting on the first policy-locked one.

.github/workflows/test.yml

@@ -105,14 +105,17 @@ jobs:
         continue-on-error: true
         shell: pwsh
         run: |
-          try {
-            foreach ($dir in @($env:GITHUB_WORKSPACE, $env:RUNNER_TEMP, $env:TEMP, "$env:USERPROFILE\.bun")) {
-              if ($dir) { Add-MpPreference -ExclusionPath $dir -ErrorAction Stop }
+          $applied = 0
+          foreach ($dir in @($env:GITHUB_WORKSPACE, $env:RUNNER_TEMP, $env:TEMP, "$env:USERPROFILE\.bun")) {
+            if (-not $dir) { continue }
+            try {
+              Add-MpPreference -ExclusionPath $dir -ErrorAction Stop
+              $applied++
+            } catch {
+              Write-Host "Defender exclusion failed for ${dir}: $($_.Exception.Message)"
             }
-            Write-Host "Defender path exclusions applied."
-          } catch {
-            Write-Host "Defender exclusions not applied: $($_.Exception.Message)"
           }
+          Write-Host "Defender path exclusions applied: $applied"
       # kilocode_change end
 
       - name: Checkout repository