fix(runtime): reconcile workflow timeouts fail closed

[doublewhy]

Plain-language summary

• Context: The control plane periodically checks running workflows and marks them timed out only after their configured wall-clock limit has actually elapsed. A timeout may also trigger compensation work.
• Problem: Malformed, offset-free, future, or non-monotonic persisted timestamps could be swallowed or misclassified, and floating-point rounding over very large spans could declare a timeout slightly early. That can either silently disable reconciliation or create false timeout and compensation evidence.
• Fix: Treat persisted clocks as untrusted input, require explicit offsets and monotonic ordering, fail without changing state when evidence is invalid, and compare exact integer elapsed seconds before producing a timeout.

Issue closed

Closes #1102

What changed

• Parses the reconciliation clock once and rejects malformed or naive values.
• Requires started_at <= updated_at <= reconciliation clock.
• Validates persisted workflow state and timeout configuration strictly.
• Leaves history, status, and compensation unchanged when time evidence is invalid.
• Uses exact whole-second arithmetic instead of float total_seconds() or overflow-prone timestamp addition.
• Keeps terminal reconciliation idempotent across restart.

Verification

• Focused timeout suite: 35 passed.
• Timeout plus control-plane API selection: 37 passed, 31 deselected.
• Changed production code: 100% executable-line and branch coverage.
• Ruff, repository policy, governance traceability, and diff hygiene pass.
• Canonical default suite on this macOS host: 6,430 passed, 1 skipped; the remaining 18 failures are unchanged current-dev libvirt tests that require /usr/bin/busybox and are addressed separately by fix(libvirt): bind reproducible guest operations to fresh evidence #1128.
• Rebuilt on current dev at 3d6e369b726607ff657a841c7f1dee0bec655b8f.

Scope

This PR covers only workflow timeout proof and reconciliation. Concurrent participant reservations/settlement (#1101), HTTP admission, and durable operation storage are separate successors.