hermes - 💡(How to fix) Fix time_reconciler: add Timing adapter and approval-only executor

Parent: #29631

Goal

Implement a Timing provider adapter and approval-only executor for time_reconciler.

Scope

• Add Timing adapter methods for:
  • list projects/project hierarchy
  • fetch activity blocks
  • fetch existing time entries
  • create approved time entries
• Credentials must come from configurable env var names, e.g. TIMING_API_KEY, and never be serialized into artifacts.
• Executor must consume only an explicit approved manifest, not raw LLM proposals.
• Executor must write an audit result with created/updated entry references.

Acceptance Criteria

• Adapter can be unit-tested with mocked HTTP responses.
• Executor refuses unapproved proposal manifests.
• No secrets appear in logs/artifacts.
• Timing-specific code is isolated behind provider interface.
• Tests use mocked/synthetic Timing data only.