fix(timeout): honor caller-owned execution deadlines

[drewstone]

Problem

Runtime asked for a 14,400,000ms Pi turn, but cli-bridge discarded that field and killed the process at its unrelated 300,000ms default.
The same process could also be preempted by hidden backend timers, a 600,000ms Docker slot timer, a 7,200-second systemd scope cap, or the OpenCode wrapper.

Change

• Accept and validate execution.timeoutMs on the structured chat request.
• Enforce one effective deadline at the durable-run boundary and pass its abort signal to every backend.
• Treat backend timeout settings only as operator fallbacks when the caller omits a deadline.
• Default all process, sandbox, Docker slot, and systemd lifetime caps to disabled; explicit operator caps remain available and documented.
• Forward the exact effective deadline into sandbox tasks and the OpenCode wrapper.
• Preserve explicit cancellation, process-tree termination, retained terminal errors, disconnect/replay behavior, and request identity.

Completion criteria

• A 14,400,000ms caller deadline reaches the backend unchanged.
• An explicit caller deadline wins over backend and ambient wrapper settings.
• Omitted deadlines have no silent 5-minute, 10-minute, or 2-hour cutoff by default.
• Invalid wire and environment values fail before work starts.
• A real 25ms deadline aborts through the production route and returns a typed HTTP 504 without wall-clock waiting.
• Durable-run disconnect/replay semantics remain unchanged.
• Docker slots are not silently recycled when their optional operator cap is disabled.
• Public configuration and request behavior are documented.

Verification

• pnpm test — 608 passed, 6 skipped across 35 files.
• pnpm vitest run tests/execution-timeout.test.ts tests/opencode-worker-timeout.test.ts tests/durability.test.ts — 25 passed.
• pnpm typecheck — pass.
• pnpm build — pass.
• Pre-push checks — mergeable with origin/main, trace-contract tests pass, no suspicious secrets.

No paid Claude or Codex model run was used.
The intermittent jailed Pi credential-resolution failure is separate and retained with full completion criteria in #106; the current isolated resolver probe passes, so this PR does not add a speculative fix.

Runtime propagation is in tangle-network/agent-runtime#727.
Both PRs must merge before rerunning the Discovery pursuit.