Thrown when a protected call exceeds its per-attempt timeout deadline.

Because the protected-call signature is () => Promise<T> with no AbortSignal, the underlying operation is not cancelled — it runs to completion in the background; only the caller's await rejects. (M47 made the timeout CANCEL the per-attempt work when the caller supplies a signal; the status below is what the caller is told either way.)