Reap hung builds with a per-job timeout

[ericmj]

A job that hangs — a stuck docker build, docker push, wget, etc. — blocks its runner task indefinitely and keeps counting its weight against the shared concurrency budget. Once enough builds wedge to saturate the budget, the agent stops pulling any new :shared jobs (Erlang/Elixir/OTP builds) while separate-budget DockerManifest jobs keep flowing — so the agent looks alive but builds nothing until the wedged processes are killed by hand.

Two layers:

Per-job timeout (Bob.Script). Every shell-out job (erlang/elixir/manifest/otp/clean) runs through Bob.Script, so the whole script is wrapped in GNU timeout there — bounding the job no matter where it hangs, not just in docker build. Run without --foreground, timeout signals the entire process group, so the script's docker children die with it (verified on the agent: a grandchild process is reaped, no orphan); killing the docker client also makes the daemon cancel the build. timeout ships only on Linux, so non-Linux dev runs the script unwrapped.

Runner per-task backstop (Bob.Runner). The master already reaps stale running rows after 3h (Bob.Queue.Maintenance), but nothing reaps the task on the agent, so a leak would persist if a task wedged outside the script. Bob.Runner now arms a per-task timer at the same threshold; on fire it kills the task to free its weight, reports the job failed, and pulls fresh work. It fires before the master sweep's tick-granular detection, so it wins the race and avoids spawning a duplicate via requeue.

All three timeouts are 3h. Does not fix the underlying OTP-21 parallel-make deadlock that triggered this — those builds now fail cleanly instead of wedging the agent.