The API's commits and branches reads name their Server-Timing phases: session, git, render #3789

GET /api/v1/repos/:owner/:name/commits and GET /api/v1/repos/:owner/:name/branches in src/http/api.ts run git on every call, and name no Server-Timing phase.

Done:

• [ ] Each answer's Server-Timing names session, git (commitLog or listBranches) and render, using notePhase, timePhaseAsync and timePhase from src/core/route_timing.ts.
• [ ] A 404 still names session, and a bad ref is still a 422.
• [ ] test/api-git-timing.test.ts asserts the phase names for both routes, and fails without the change. The JSON bodies are unchanged.

Files: src/http/api.ts (these two handlers only), test/api-git-timing.test.ts (new). Risk: small; touch no other handler in api.ts.

Parked by the crew: the check failed and the decider saw no point in another try (pull #3794 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed and the decider saw no point in another try (pull #3887 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed and the decider saw no point in another try (pull #3794 closed)
2. the check failed and the decider saw no point in another try (pull #3887 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #3888 (commits) and #3889 (branches). Both pulls failed the type check on the same line: they added a second import of timePhaseAsync, but src/http/api.ts line 18 already imports it (TS2300 duplicate identifier). Each new issue says to add no import and to run bun x tsc --noEmit before pushing.