Exec defaults for sandboxed builds: total-lifetime timeout and watchdog semantics

[cf-pages]

Targeted: 0.5.0 (reliability program). Baseline: release/0.3.0.

timeout_ms defaults to 30000 (exec_command input schema) and the watchdog kills the process group at the deadline. On small sandboxes (2C/4G) install/build/test reliably exceed 30 s, so the default turns routine builds into kills. yield_time_ms (foreground window, default 10 s) is already a separate knob — the gap is the lifetime default and the watchdog's treatment of deliberately backgrounded work.

• Raise the default total lifetime to 120–300 s and make it deployable via env var; document "foreground window vs process lifetime" in the schema descriptions.
• Watchdog should not pre-empt commands the model explicitly backgrounded (yield_time_ms: 0, or subsequently polled) before the hard timeout_ms cap.
• Status must distinguish timeout | killed | exited, with the real exit code (pairs with the telemetry outcome split).
• Longer lifetimes × MAX_ACTIVE_COMMANDS = 16 changes the resource envelope — document, and leave fairness to Per-client resource quotas for the shared workspace runtime #46.