fix: default timeout on outbound fetch calls

[hugo-ccabral]

Summary

• Mirrors fix: default timeout on outbound fetch calls blocks#392. Nothing bounded how long an outbound fetch() could hang — a stuck upstream connection (VTEX/CDN holding a TCP connection open) pins request context in memory until the runtime kills the isolate.
• Adds commerce/utils/fetchTimeout.ts: withFetchTimeout() / withTimeoutSignal(), native AbortSignal.timeout() composed with AbortSignal.any() so a caller-supplied signal is never dropped. Default 10s.
• Wires it into the VTEX _fetch fallback + fetchSafe/fetchAPI, Magento's magentoFetch, Resend's sendEmail, Shopify's createGraphqlClient fallback, and the Google Fonts loader.
• This repo pins @decocms/start@6.6.1, which predates the equivalent export in blocks, so the helper is duplicated locally for now. Once the dependency bumps past the version shipping sdk/fetchTimeout, replace this file with a re-export and delete the copy.

Test plan

• Manually verified against the identical, already-tested implementation in fix: default timeout on outbound fetch calls blocks#392 (all touched files there are byte-identical mirrors of this repo's)
• Could not run this repo's test/typecheck locally (no node_modules installed in this environment) — recommend CI confirms magento/client.ts, resend/tests/send.test.ts, vtex/client.ts, vtex/utils/fetch.ts, shopify/utils/graphql.ts, website/loaders/fonts/googleFonts.ts all still pass

🤖 Generated with Claude Code

---

Summary by cubic

Add a default 10s timeout to all outbound fetch() calls to stop hung upstreams from pinning request context. Ban bare fetch to enforce the wrapper; the timeout helper is duplicated locally until @decocms/start exposes it.

• Bug Fixes

  • Added commerce/utils/fetchTimeout.ts with withFetchTimeout() and withTimeoutSignal() (10s default).
  • Applied to VTEX (client default, fetchSafe, sitemap proxy), Magento (magentoFetch), Resend (sendEmail), Shopify (GraphQL client fallback), and the Google Fonts loader.
  • Updated Resend tests to expect an AbortSignal in requests.

• Refactors

  • Added Biome noRestrictedGlobals rule to ban bare fetch in vtex/**, magento/**, resend/**, shopify/**, and website/** (excluding hooks/tests); use the wrapped clients or withFetchTimeout.
  • Introduced a FetchFn alias and replaced typeof fetch annotations to satisfy the lint rule.

^{Written for commit cbf588e. Summary will update on new commits.}