feat: per-job command timeout with global default

Add an optional per-job run timeout following the overlap_policy inherit
pattern: Job.TimeoutSeconds (0 = inherit) resolves against a new
Config.DefaultTimeoutSeconds (default 30s), replacing the hard-coded 30s
guard in runner.RunJob.

- domain/storage: new fields, default 30, load-time normalization
- runner: RunJob takes an explicit timeout; StartOnly stays untimed so it
  keeps measuring launch latency only
- app: effectiveTimeout resolves under mu into runEnv, threaded to runJob;
  seam signature and validation updated; DisplayTimeout helper
- ui: Timeout entry in the job dialog, Default timeout in Settings, and a
  Timeout row in the details panel
- tests + docs (ARCHITECTURE, STANDARDS, ROADMAP, CHANGELOG) updated;
  version bumped to 0.12.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable GoSentry changes are recorded in this file.
 
+## 0.12.0 - 2026-07-25
+
+**Per-job command timeout:**
+- Each job may now set its own run timeout (seconds) in the job dialog; leaving
+  it empty inherits a new **Default timeout** in Settings (default 30s), the same
+  inherit pattern as the overlap policy. The details panel shows the effective
+  value, marking inherited jobs as `(global default)`.
+- The formerly hard-coded 30s guard in `runner.RunJob` is now the configurable
+  default. `StartOnly` fire-and-forget jobs remain unaffected by the run timeout,
+  continuing to measure launch latency only.
+
 ## 0.11.5 - 2026-07-01
 
 **Quality and documentation polish:**