The API's commits list names its Server-Timing phases: session, git, render #3888

Part of #3789, split after two pulls failed the check with src/http/api.ts(256,49): error TS2300: Duplicate identifier 'timePhaseAsync'. src/http/api.ts line 18 already imports notePhase, takeSessionTime, timePhase, timePhaseAsync from ../core/route_timing.ts: add no import line. Follow the pattern of GET /api/v1/repos/:owner/:name/pulls/:number in the same file.

Done:

• [ ] GET /api/v1/repos/:owner/:name/commits notes session first (notePhase(ctx.request, "session", takeSessionTime(ctx.request))), wraps commitLog in timePhaseAsync(..., "git", ...) and the JSON answer in timePhase(..., "render", ...), on both the success path and the empty [] path.
• [ ] A missing repository is still a 404 whose Server-Timing names session; a bad ref is still a 422 bad_ref; the JSON body is unchanged.
• [ ] test/api-commits-timing.test.ts (new) asserts the three phase names and the 404, and fails without the change.
• [ ] bun x tsc --noEmit passes before the push.

Files: src/http/api.ts (this handler only), test/api-commits-timing.test.ts. Risk: small; touch no other handler and no import.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3912 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3912 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.