fix(workspace): re-apply agent ownership after refresh fetch

I1: _fetch_origin_best_effort runs as root and writes new pack files
+ ref updates that land root-owned, undoing _ensure_agent_owned that
ran before. Subsequent spawns hit Permission denied. Mirror the
fetch_branch_for_inspection pattern: re-run _ensure_agent_owned AFTER
the fetch.

I2: separate workspace_refresh_fetch_timeout_seconds (default 60s)
from workspace_clone_timeout (300s). Refresh transfers small deltas;
300s of blocking on every spawn against a hung remote is operationally
bad. 60s is enough for any sane refresh.

roboco/config.py

@@ -238,6 +238,17 @@ class Settings(BaseSettings):
         ge=30,
         description="Timeout in seconds for git clone operations",
     )
+    workspace_refresh_fetch_timeout_seconds: int = Field(
+        default=60,
+        ge=5,
+        description=(
+            "Timeout in seconds for the best-effort `git fetch origin` "
+            "that runs on every healthy-clone re-entry into "
+            "ensure_workspace. Refresh fetches transfer small deltas only "
+            "— blocking 300s (the full-clone timeout) on every spawn "
+            "against a hung remote is operationally bad."
+        ),
+    )
 
     # ==========================================================================
     # Agent Guardrails (per-session budgets, loop detection, SLAs)