fix: validate timeouts and clean up cancellation

[Sam Schillace (ramparte)]

Summary

• validate configured and per-call timeouts as integer seconds in the inclusive 1..3600 range, with schema bounds and a milliseconds hint
• share bounded process-tree cleanup between timeout and external cancellation paths
• defer repeated cancellation until cleanup finishes, then propagate CancelledError
• add regression coverage for validation, process-group cleanup, cancellation during timeout cleanup, and repeated cancellation

Incident class

A value such as 1200000, intended as milliseconds, was previously accepted as 1,200,000 seconds (nearly 14 days). That could leave a command running far beyond the caller's intent. The tool now rejects values outside 1..3600 seconds and suggests the plausible seconds value when an oversized integer looks like milliseconds.

Cleanup behavior and platform limits

Foreground timeout and cancellation now use the same bounded cleanup path. On Unix, the command process group is terminated and reaped. On Linux, cleanup additionally walks /proc before signaling to find descendants that escaped the original process group via setsid().

Detached-descendant discovery is necessarily best-effort and Linux-specific: it depends on /proc and a preserved PPID chain at snapshot time. Other Unix platforms still receive process-group cleanup, but cannot use this Linux /proc fallback; Windows retains main-process cleanup behavior.

Verification

uv run pytest -q
80 passed, 7 skipped

Related delegate watchdog: microsoft/amplifier-foundation#298. The delegate-side watchdog and this tool-side validation/cleanup provide defense in depth.