Add optional per-call subagent timeouts

Add a call-level timeout field, validate it in contracts, and enforce it in runner so child runs can fail after a configured wall-clock period while keeping the default unlimited behavior.