feat(google_adk): add ADK-114, TypeScript FunctionTool HTTP call has no timeout

[bradAGI]

ADK-003 covers the Python side of network timeouts; the TypeScript half was missing, even though the pack ships TS rules (ADK-013, ADK-015, ADK-016, ADK-109). OpenAI (OAI-016, OAI-024) and the Vercel AI SDK (VAI-011) already use has_http_call_without_timeout for exactly this.

The composition ADK encourages makes the stall worse rather than better, which is the part worth having in the finding text:

• inside a SequentialAgent, a stalled tool blocks every step after it;
• inside a ParallelAgent, the whole fan-out waits on its slowest branch — so one unresponsive host stalls work that has nothing to do with it.

And the limit people reach for doesn't apply: ADK-108's max_iterations bounds how many times a LoopAgent goes round, not how long one tool call may run. No configured limit breaks this stall.

Compounds with ADK-016 the same way VAI-011 compounds with VAI-003 — a tool that fetches a caller-controlled URL and can't time out can be steered at an internal host that never answers.

Numbered ADK-114 to leave room for ADK-111 in the open PR #51 and ADK-112 in my #79.

Verification — engine built at main:

$ trustabl rules validate .
OK: 85 rule pack(s), 207 rule(s) valid under rule schema version 14

Fire (bare await fetch(...) in a new FunctionTool({ ..., execute }) handler): ADK-016, ADK-114, ADK-201
Silent (signal: AbortSignal.timeout(15_000)): ADK-016, ADK-201

(ADK-016 is the pre-existing TS SSRF rule firing on the template-string URL — also the compounding case described. ADK-201 is the missing-AGENTS.md repo rule.)

My first fixture used new FunctionTool(fn, {...}) and nothing fired, including the pre-existing TS rules — the adk-js shape is the options-object form with an execute callback. Worth flagging since the Python FunctionTool(fn) wrapper reads as the obvious analogue and isn't what the TS SDK does.

No new predicates, so no schema_version bump.