fix: retry transient organization verification failures in CI

src/org-context.js

@@ -120,9 +120,10 @@ export function resolveUserOrganization(directory, user) {
   return selected ? { status: 'resolved', ...selected } : { status: 'ambiguous_membership' };
 }
 
-export async function getOrgDirectory(env, { fetchImpl = fetch, now = Date.now } = {}) {
+export async function getOrgDirectory(env, { fetchImpl = fetch, now = Date.now, timeoutMs = 5000 } = {}) {
   const config = orgContextConfig(env);
   if (!config) return null;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60000) throw new Error('org_context_invalid_timeout');
   // Include credential rotation without storing the secret in cache keys or diagnostic output.
   const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(config.keySecret)));
   const fingerprint = Array.from(digest, (byte) => byte.toString(16).padStart(2, '0')).join('');
@@ -140,7 +141,7 @@ export async function getOrgDirectory(env, { fetchImpl = fetch, now = Date.now }
         url.searchParams.set('tenantId', config.roots[index]);
         url.searchParams.set('exposure', 'identifiers');
         const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), 5000);
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
         try {
           const response = await fetchImpl(url.toString(), {
             headers: { accept: 'application/json', 'X-Baron-Key-ID': config.keyId, 'X-Baron-Key-Secret': config.keySecret },