fix: bound workflow agent timers to the enclosing budget

[ooiuuii]

Why

A valid finite agent timeout above Node's signed 32-bit timer limit (for example agent('wait', { timeoutMs: 2147483648 })) overflows to 1 ms. The actual workflow VM/dispatcher therefore fails almost immediately instead of waiting for a report.

Approach

Clamp finite per-agent delays to the existing MAX_WORKFLOW_DURATION_MS. The enclosing workflow is already bounded by that duration, so this reuses the existing limit rather than introducing a new policy. Keep ordinary/default/invalid-input behavior and timer cancellation ownership unchanged.

Add seven integration cases through the real workflow VM/executor, native timers, SQLite, PTY and HTTP report/stop routes. The passive CLI fixture does not contact a provider.

Validation

New checks on 2026-10-09, Node 24.19.0, main f8f1343:

• RED: 4 failed / 3 passed, including explicit TimeoutOverflowWarning for 2147483648 and 1e15
• GREEN: 7/7; delayed reports at 2000, 2147483647, 2147483648 and 1e15 ms; ordinary timeout, user stop and enclosing-budget cancellation, including persisted dispatch state and worker cleanup
• Related six-file suite: 48/48 with --testTimeout=20000. Default 5-second invocation had one existing maxAgentCalls timeout, reproduced on clean main; no assertions or product budgets changed
• pnpm check, pnpm build, changed-file formatting, git diff --check and clean-main patch application passed
• Full pnpm test ran 01:44:12–01:54:06 UTC with unchanged serial/60-second defaults: 2695 passed, 4 failed, 4 skipped (404 files). Full gate is NOT green. One PTY descendant-cleanup assertion and three package-tarball checks reproduced on clean main; package failures cannot create /home/agent/.npm/_cacache
• Whole-project tsc retains two TS2352 errors in unchanged workspace-shell-runtime.test.ts, also reproduced on main
• One scoped review found no blockers; later test-only TypeScript narrowing correction was rerun through all seven native cases

CI selects the full/native platform and package matrix; those remote jobs are not locally verified. No 25-day expiration was awaited: the native overflow boundary is tested with delayed reports and cancellation/outer-budget controls. No real provider, browser/mobile or release publication validation is claimed. Existing trust-store EROFS and inactive-PTY cancellation diagnostics are retained; no permission changes were made.