- Replace NamedTemporaryFile with mkstemp to avoid leaking an open fd
- Increase subprocess timeout from 30s to 60s for CI headroom
- Retry once on empty-output failure (signal-killed by OOM/CPU starvation)
- Include return code in failure message for easier diagnosis