fix: bound commit conflict retry backoff

[lance-gatekeeper]

Summary

• bound attached and detached commit-conflict backoff by a shared 30-second retry budget
• add CommitBuilder::with_retry_timeout for callers that need a different budget
• reuse the write-retry timeout helper and clean up transaction files on timeout
• add regression coverage with the outer commit timeout disabled

Root cause

commit_transaction derived SlotBackoff delays from the first attempt latency but awaited each delay directly. A slow first attempt could therefore produce a backoff sleep longer than the intended retry wall-clock budget.

Validation

• cargo fmt --all -- --check
• cargo test -p lance commit_retry_timeout --lib
• cargo test -p lance test_commit_timeout --lib
• cargo test -p lance --doc with_retry_timeout
• cargo clippy --all --tests --benches -- -D warnings

Fixes #7882

[lance-gatekeeper]

Gate recommendation: approve. The change addresses the unbounded latency-scaled sleep at the commit boundary, applies one remaining-time budget across attached and detached retry backoff, and preserves commit-outcome verification before cleanup. Reusing the existing timeout semantics is preferable to changing SlotBackoff globally because unrelated contention behavior remains unchanged.