fix(polymarket-us): prevent websocket connect hangs with garbage-collected timeout

[AbhilashG12]

Description

Fixes #722.

The PolymarketUS WebSocket adapter lacked a connection timeout, meaning network partitions or unreachable endpoints during the TLS/TCP handshake would cause socket.connect() to hang indefinitely, blocking watchOrderBook() and watchTrades().

This PR implements the requested timeout but wraps it in a try/finally block with clearTimeout. This ensures that successful connections immediately garbage-collect the timer, preventing dangling callbacks from polluting the Node.js event loop during high-frequency reconnects.

[realfishsam]

PR Review: PASS (NOT VERIFIED)

What This Does

Wraps Polymarket US WebSocket connection setup in a 15s timeout and clears the timer in finally, so watchOrderBook / watchTrades callers are not left waiting forever on a stuck connect.

Blast Radius

Polymarket US WebSocket initialization only: core/src/exchanges/polymarket_us/websocket.ts. No schema, SDK API, or router changes.

Consumer Verification

Before (base branch):
Static trace: ensureInitialized() awaited socket.connect() directly; if that promise never settled, consumer calls to watchOrderBook() / watchTrades() could hang before reaching the existing watch-data timeout.

After (PR branch):
Static trace: ensureInitialized() races socket.connect() against a 15000ms timeout and clears the timer (websocket.ts:148-165), so the consumer call rejects on connection hang. I did not perform a live Polymarket US WebSocket hang simulation.

Test Results

• Build: PASS for current main core build during scheduled run
• Unit tests: PASS for current main core Jest (699 passed, 3 skipped)
• Server starts: NOT VERIFIED for this PR head
• E2E smoke: NOT VERIFIED (no live WS simulation)

Findings

No blocking findings.

PMXT Pipeline Check

• Field propagation (3-layer): N/A
• OpenAPI sync: N/A
• Financial precision: N/A
• Type safety: OK
• Auth safety: N/A

Semver Impact

patch -- WebSocket reliability fix.

Risk

The timeout path does not explicitly close the partially connecting socket; if the underlying SDK continues connecting after the race rejects, it may need follow-up cleanup hardening.