ci: replace coop-shard wall-clock timeout with per-test budget enforcement

[NonPolynomialTim]

What

Replaces the per-shard 25-minute CI wall-clock timeout on the coop-shard
job (both ci-main.yml and ci-validate.yml) with per-test budget
enforcement:

• New tools/coop_test/slow_test_exceptions.json — single source of truth:
  default_budget_s 180, hard_kill_multiplier 2.0, max_budget_s 900 hard cap
  (no unlimited entries; the runner errors on load if an exception exceeds the
  cap), plus 7 seeded exceptions carrying their observed CI durations.
• tools/ci/run_coop_suite.ps1 (the CI shard runner) reads that JSON and enforces
  it: a test that finishes over budget fails the suite even if it passed; a
  test still running at 2× its budget is hard-killed with its game subtree and
  failed, so a hang can never wedge a shard now that the wall is gone. Real
  failures still retry once; hangs are never retried.
• Both workflows: removed the 25-min step timeout on the "Coop test suite" step;
  raised the coop-shard job cap 30 → 60 as a coarse runaway backstop only (the
  per-test budgets are the primary bound — leaving 30 would have re-capped the
  shard and defeated the removal).

Why

The 25-minute shard wall is the wrong bound: the suite only grows, so a fixed
wall goes stale and starts killing healthy shards. In run 31999655291 it
spuriously killed 2 of 4 shards ("timed out after 25 minutes") that happened to
carry test_coop_debrief_sync (529.8s) and test_parallel_soak (305.8s). A
per-test budget keeps a single pathological test bounded while letting the suite
grow.

Why a separate PR (unblocks #166)

This is cherry-picked from PR #166 (commit 835be08a0) so the CI change can
land on main on its own. The merge gate is ci-validate.yml, which runs on
pull_request_target — GitHub always takes that workflow from the base
branch, so the wall removal only takes effect for the gate once it is on main.
Landing it here activates the change for every subsequent PR while #166 is still
being stabilized.

The PR #166 hunk to tools/coop_test/run_parallel.py (a branch-only local
K-lane runner that does not exist on main and is not invoked by the CI
coop-shard gate) is intentionally omitted; the four CI-effective files are
applied verbatim from 835be08a0.

Validation

• Staged files byte-identical to 835be08a0 for all four (ci-main.yml,
  ci-validate.yml, run_coop_suite.ps1, slow_test_exceptions.json).
• run_coop_suite.ps1: PowerShell AST parse clean; both workflows parse as YAML;
  slow_test_exceptions.json parses as JSON; no timeout-minutes: 25 remains;
  coop-shard job cap is 60 in both.
• Fake-tree dry run (stub exit 0 tests, no game launched): the loader tolerates
  the 7 exception entries even though none match the present tests (the
  main-suite condition — several of those tests live only on the Parallel battlescape turns + per-action desync detection, reporting, and crash bundling #166 branch), the
  present tests PASS, exit 0.
• Original enforcement commit was fully validated on the feature branch with fake
  sleeping tests: pass-under-budget, budget-exceeded-but-completed,
  hang-hard-killed-at-2× (killed at 2s not 30s), real-failure-retried, and
  over-cap rejection. No product C++ touched; Python/PowerShell/YAML only.

🤖 Generated with Claude Code