Runtime: add unified operation deadlines

[turinglambdaai]

Summary

Adds a Runtime-owned deadline model for long mutation/observation work so Agents, CLI and future workflow execution can distinguish execution-budget expiry from caller cancellation and semantic/device timeouts.

Runtime semantics

• optional deadlineMs for power on/off, flash/reset and serial observations;
• first cancellation cause wins deterministically: caller cancellation, explicit Runtime cancel, or deadline;
• active operation/observation metadata includes deadlineAtUtc and deadlineExceeded;
• history records a distinct deadline_exceeded state;
• compact runtime.deadline evidence records deadline metadata;
• late success from a driver that ignores cancellation is rejected after the Runtime deadline;
• existing drain/caller-cancellation compatibility is preserved for uncooperative drivers that do not observe cancellation;
• emergency power-off deliberately has no Runtime deadline.

Transport / shells

• deadlineMs is an API query parameter, leaving existing request-body schemas intact;
• Runtime returns HTTP 408 with stable code=deadline_exceeded;
• Benchpilot.Client keeps HttpClient.Timeout infinite so Runtime is the single execution-budget authority;
• CLI exposes --deadline-ms and stable exit code 6;
• MCP power/flash/serial tools expose optional deadlineMs.

serial wait --timeout-ms remains a semantic assertion window: an unmatched wait is still a normal result/exit 1. --deadline-ms is a separate outer Runtime execution budget.

Tests and smoke

Runtime tests cover:

• mutation deadline classification/history/evidence;
• observation deadline distinct from serial semantic timeout;
• caller cancellation remains cancelled;
• uncooperative late-success drivers are rejected after deadline;
• active deadline metadata;
• invalid non-positive deadlines.

Resident Runtime smoke verifies the real CLI -> Client -> HTTP Runtime path:

• serial wait ... --deadline-ms 100 returns CLI exit code 6;
• API payload is code=deadline_exceeded with deadline metadata;
• observation history records deadline_exceeded;
• evidence contains runtime.deadline.

Documentation / cleanup

• README documents deadline semantics and exit code 6;
• ROADMAP marks the Runtime deadline model complete;
• existing xUnit Assert.Single(...Where...) analyzer warnings were removed without changing test semantics.

Validation

Validated on final head d403686 / CI run #152:

• Windows restore/build/89 tests pass;
• Ubuntu restore/build/89 tests pass;
• Ubuntu resident Runtime/CLI smoke passes, including deadline API/history/evidence assertions;
• Ubuntu graceful-shutdown smoke passes;
• build is clean of the previously reported xUnit2031 warnings.

Scope

This PR does not change device-driver internal timeout policies, add CAN/UDS, or impose deadlines on emergency safety shutdown.