The API's read of one commit names its Server-Timing phases: session, git, diff, render #3900

GET /api/v1/repos/:owner/:name/commits/:oid in src/http/api.ts runs commitLog and then diffCommit on every call and names no Server-Timing phase, so a slow diff can't be told apart from a slow log. Follow GET /api/v1/repos/:owner/:name/pulls/:number in the same file. The file already imports notePhase, takeSessionTime, timePhase, timePhaseAsync from ../core/route_timing.ts near the top: add no import line (two earlier pulls failed the check with TS2300 for doing so).

Done:

• [ ] The handler notes session first, wraps commitLog in timePhaseAsync(..., "git", ...) and diffCommit in timePhaseAsync(..., "diff", ...), and builds the JSON answer inside timePhase(..., "render", ...).
• [ ] A missing repository, an unsafe rev and an unknown commit are each still a 404 whose Server-Timing names session; the JSON body is unchanged.
• [ ] test/api-commit-timing.test.ts (new) asserts the four phase names on a real commit and session on a 404, and fails without the change.
• [ ] bun x tsc --noEmit passes before the push.

Files: src/http/api.ts (this handler only; leave /commits/:oid/check as it is), test/api-commit-timing.test.ts. Risk: small; touch no other handler and no import.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3916 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3916 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.