feat: per-job command timeout with global default

Add an optional per-job run timeout following the overlap_policy inherit
pattern: Job.TimeoutSeconds (0 = inherit) resolves against a new
Config.DefaultTimeoutSeconds (default 30s), replacing the hard-coded 30s
guard in runner.RunJob.

- domain/storage: new fields, default 30, load-time normalization
- runner: RunJob takes an explicit timeout; StartOnly stays untimed so it
  keeps measuring launch latency only
- app: effectiveTimeout resolves under mu into runEnv, threaded to runJob;
  seam signature and validation updated; DisplayTimeout helper
- ui: Timeout entry in the job dialog, Default timeout in Settings, and a
  Timeout row in the details panel
- tests + docs (ARCHITECTURE, STANDARDS, ROADMAP, CHANGELOG) updated;
  version bumped to 0.12.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -5,18 +5,6 @@ Completed work is recorded in [CHANGELOG.md](CHANGELOG.md), not here.
 
 ## Open Items
 
-### Per-job command timeout
-
-`runner.RunJob` applies a fixed **30s** timeout to every command (`commandTimeout`
-in `src/runner/runner.go`). Long-running or interactive scripts need a longer
-limit; quick health checks may need a shorter one.
-
-Add an optional per-job timeout (seconds) on `domain.Job`, with a global default
-in `gosentry.json` for jobs that leave the field empty — the same inherit pattern
-as `overlap_policy`. Wire the value through `RunJob`; expose it in the job dialog
-and Settings; validate on save. `StartOnly` jobs should keep measuring launch
-latency only and remain unaffected by the run timeout.
-
 ### Window size persistence *(frozen)*
 
 Window size is currently **not** saved on quit or close. Saving was disabled