feat: per-job command timeout with global default

Add an optional per-job run timeout following the overlap_policy inherit
pattern: Job.TimeoutSeconds (0 = inherit) resolves against a new
Config.DefaultTimeoutSeconds (default 30s), replacing the hard-coded 30s
guard in runner.RunJob.

- domain/storage: new fields, default 30, load-time normalization
- runner: RunJob takes an explicit timeout; StartOnly stays untimed so it
  keeps measuring launch latency only
- app: effectiveTimeout resolves under mu into runEnv, threaded to runJob;
  seam signature and validation updated; DisplayTimeout helper
- ui: Timeout entry in the job dialog, Default timeout in Settings, and a
  Timeout row in the details panel
- tests + docs (ARCHITECTURE, STANDARDS, ROADMAP, CHANGELOG) updated;
  version bumped to 0.12.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/STANDARDS.md

@@ -17,12 +17,13 @@ in [ARCHITECTURE.md](ARCHITECTURE.md); test conventions in [TESTS.md](TESTS.md).
 - `RunNow` is allowed during global pause and for disabled jobs.
 - Sequential mode runs jobs FIFO by order in `jobs.json`.
 - Scheduler tick is 1s — sub-second `@every` intervals are not supported.
-- Command timeout is 30s globally.
+- Command timeout defaults to 30s globally and is overridable per job
+  (`Job.TimeoutSeconds`, 0 = inherit `Config.DefaultTimeoutSeconds`).
 - **History tab is session-only.** `JobRuntime.Logs` exists only in memory for the
   current process. Log files on disk feed aggregate statistics via `SeedStats`
   only. See [ARCHITECTURE.md](ARCHITECTURE.md).
 
 ## Out of scope
 
-Larger or blocked work is tracked in [ROADMAP.md](ROADMAP.md) (per-job timeout,
-window size persistence, History column filters, CI coverage gate).
+Larger or blocked work is tracked in [ROADMAP.md](ROADMAP.md) (window size
+persistence, History column filters, CI coverage gate).