Timeout in seconds for a sandbox glob round-trip.
The remote script bounds its own walk (TIME_BUDGET in sandbox.py), but that
covers neither interpreter startup, the sandbox round-trip, nor transferring up
to MAX_MATCHES records. Without an outer bound a wedged sandbox hangs the
caller indefinitely.
