feat(limits): expose runtime limit config

[NathanFlurry]

• Expose JS CPU/wall-clock/import-cache limits, JS sync-RPC wait, Python old-space, and WASM prewarm/runner heap limits in the TypeScript and Rust Agent OS config surfaces.
• Preserve those fields through Rust client create-VM serialization.
• Update the resource-limits example and docs to show the full typed limits surface instead of env configuration.

Depends on:

• feat(limits): wire runtime limits through VM config secure-exec#270

Validation:

• secure-exec dependency PR: cargo check -p secure-exec-sidecar-core -p secure-exec-execution -p secure-exec-sidecar passed.
• Agent OS Rust check is currently blocked by the local secure-exec prerelease version mismatch in this workspace.
• Agent OS TS/docs checks were attempted but require built linked secure-exec/registry packages in this workspace.

[railway-app]

🚅 Deployed to the agentos-pr-1609 environment in agentos

Service	Status	Web	Updated (UTC)
agentos	😴 Sleeping (View Logs)	Web	Jul 4, 2026 at 7:12 pm

---

🚅 Environment agentos-pr-1609 in rivet-frontend has no services deployed.