fix: align gateway timeout defaults with spec §4.1.3 (#3592)

`DefaultStartupTimeout` and `DefaultToolTimeout` were 2× the
spec-documented values (60s vs 30s, 120s vs 60s), causing observable
gateway behavior to diverge from §4.1.3.

## Changes

- **`internal/config/config_core.go`**: Align constants with spec:
  ```go
  // Before
  DefaultStartupTimeout = 60   // seconds
  DefaultToolTimeout    = 120  // seconds

  // After
  DefaultStartupTimeout = 30  // seconds (per spec §4.1.3)
  DefaultToolTimeout    = 60  // seconds (per spec §4.1.3)
  ```
- **`internal/launcher/launcher_test.go`** /
**`getorlaunch_timeout_test.go`**: Update hardcoded `"1m0s"` / `"60
seconds"` references to match the new default (`"30s"`). Tests that
referenced the constants directly required no changes.

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more
addresses (expand for details)</summary>
>
> #### I tried to connect to the following addresses, but was blocked by
firewall rules:
>
> - `example.com`
> - Triggering command: `/tmp/go-build3874128028/b514/launcher.test
/tmp/go-build3874128028/b514/launcher.test
-test.testlogfile=/tmp/go-build3874128028/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s
/tmp/go-build3874128028/b277/vet.cfg ify@v1.11.1/asse-errorsas
om/tetratelabs/w-ifaceassert x_amd64/vet -I rs/otlp/otlptrac-atomic -I
cpN1F_WSlTV5 -W .cfg 67475494/b288//_-ifaceassert x_amd64/vet .
--gdwarf2 475494/b288/ x_amd64/vet` (dns block)
> - Triggering command: `/tmp/go-build2871554986/b514/launcher.test
/tmp/go-build2871554986/b514/launcher.test
-test.testlogfile=/tmp/go-build2871554986/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -ato�� -bool
87c5eecb91833e7a--log-format ache/go/1.25.8/xjson
87c5eecb91833e7a/usr/lib/open-iscsi/net-interface-handler` (dns block)
> - `invalid-host-that-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build3874128028/b496/config.test
/tmp/go-build3874128028/b496/config.test
-test.testlogfile=/tmp/go-build3874128028/b496/testlog.txt
-test.paniconexit0 -test.timeout=10m0s
/tmp/go-build3874128028/b379/vet.cfg 5.0/deviceauth.ggo1.25.8
5.0/oauth2.go x_amd64/vet --gdwarf-5 nal/encoding/tex-atomic -o
x_amd64/vet -I _.a -I x_amd64/vet --gdwarf-5 go-sdk/auth -o x_amd64/vet`
(dns block)
> - `nonexistent.local`
> - Triggering command: `/tmp/go-build3874128028/b514/launcher.test
/tmp/go-build3874128028/b514/launcher.test
-test.testlogfile=/tmp/go-build3874128028/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s
/tmp/go-build3874128028/b277/vet.cfg ify@v1.11.1/asse-errorsas
om/tetratelabs/w-ifaceassert x_amd64/vet -I rs/otlp/otlptrac-atomic -I
cpN1F_WSlTV5 -W .cfg 67475494/b288//_-ifaceassert x_amd64/vet .
--gdwarf2 475494/b288/ x_amd64/vet` (dns block)
> - Triggering command: `/tmp/go-build2871554986/b514/launcher.test
/tmp/go-build2871554986/b514/launcher.test
-test.testlogfile=/tmp/go-build2871554986/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -ato�� -bool
87c5eecb91833e7a--log-format ache/go/1.25.8/xjson
87c5eecb91833e7a/usr/lib/open-iscsi/net-interface-handler` (dns block)
> - `slow.example.com`
> - Triggering command: `/tmp/go-build3874128028/b514/launcher.test
/tmp/go-build3874128028/b514/launcher.test
-test.testlogfile=/tmp/go-build3874128028/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s
/tmp/go-build3874128028/b277/vet.cfg ify@v1.11.1/asse-errorsas
om/tetratelabs/w-ifaceassert x_amd64/vet -I rs/otlp/otlptrac-atomic -I
cpN1F_WSlTV5 -W .cfg 67475494/b288//_-ifaceassert x_amd64/vet .
--gdwarf2 475494/b288/ x_amd64/vet` (dns block)
> - Triggering command: `/tmp/go-build2871554986/b514/launcher.test
/tmp/go-build2871554986/b514/launcher.test
-test.testlogfile=/tmp/go-build2871554986/b514/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -ato�� -bool
87c5eecb91833e7a--log-format ache/go/1.25.8/xjson
87c5eecb91833e7a/usr/lib/open-iscsi/net-interface-handler` (dns block)
> - `this-host-does-not-exist-12345.com`
> - Triggering command: `/tmp/go-build3874128028/b523/mcp.test
/tmp/go-build3874128028/b523/mcp.test
-test.testlogfile=/tmp/go-build3874128028/b523/testlog.txt
-test.paniconexit0 -test.timeout=10m0s -I .cfg
pkg/mod/go.opentelemetry.io/otel@v1.43.0/semconv/v1.40.0/doc.go
x_amd64/vet --gdwarf-5 g/grpc/connectiv--version -o x_amd64/vet .cfg��
/auth/apikey.go /auth/header.go x_amd64/vet -p g/grpc -lang=go1.25
x_amd64/vet` (dns block)
>
> If you need me to access, download, or install something from one of
these locations, you can either:
>
> - Configure [Actions setup
steps](https://gh.io/copilot/actions-setup-steps) to set up my
environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to the custom allowlist in this
repository's [Copilot coding agent
settings](https://github.com/github/gh-aw-mcpg/settings/copilot/coding_agent)
(admins only)
>
> </details>

Author: lpcox

internal/config/config_core.go

@@ -38,8 +38,8 @@ import (
 // Core constants for configuration defaults
 const (
 	DefaultPort              = 3000
-	DefaultStartupTimeout    = 60   // seconds
-	DefaultToolTimeout       = 120  // seconds
+	DefaultStartupTimeout    = 30   // seconds (per spec §4.1.3)
+	DefaultToolTimeout       = 60   // seconds (per spec §4.1.3)
 	DefaultKeepaliveInterval = 1500 // seconds (25 minutes) — keeps HTTP backend sessions alive
 )
 

internal/launcher/getorlaunch_timeout_test.go

@@ -75,7 +75,7 @@ func TestGetOrLaunch_TimeoutWithDefaultTimeout(t *testing.T) {
 	expectedDefault := time.Duration(config.DefaultStartupTimeout) * time.Second
 	assert.Equal(t, expectedDefault, l.startupTimeout, "Should use default startup timeout")
 
-	// We won't actually wait for default timeout in test (60s), just verify it's set
+	// We won't actually wait for default timeout in test (30s), just verify it's set
 	// The test would take too long to actually timeout
 }
 

internal/launcher/launcher_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -552,16 +553,18 @@ func TestGetOrLaunchForSession_InvalidServer(t *testing.T) {
 }
 
 func TestLauncher_StartupTimeout(t *testing.T) {
+	defaultTimeout := (time.Duration(config.DefaultStartupTimeout) * time.Second).String()
+
 	// Test that launcher respects the startup timeout from config
 	tests := []struct {
 		name            string
 		configTimeout   int
 		expectedTimeout string
 	}{
 		{
-			name:            "default timeout (60 seconds)",
+			name:            "default timeout",
 			configTimeout:   0, // 0 means use default
-			expectedTimeout: "1m0s",
+			expectedTimeout: defaultTimeout,
 		},
 		{
 			name:            "custom timeout (30 seconds)",
@@ -623,8 +626,9 @@ func TestLauncher_TimeoutWithNilGateway(t *testing.T) {
 	l := New(ctx, cfg)
 	defer l.Close()
 
-	// Should use default timeout (60 seconds)
-	assert.Equal(t, "1m0s", l.startupTimeout.String())
+	// Should use default timeout
+	expectedDefault := (time.Duration(config.DefaultStartupTimeout) * time.Second).String()
+	assert.Equal(t, expectedDefault, l.startupTimeout.String())
 }
 
 func TestLauncher_OIDCProviderInitialization(t *testing.T) {