feat: per-job command timeout with global default

Add an optional per-job run timeout following the overlap_policy inherit
pattern: Job.TimeoutSeconds (0 = inherit) resolves against a new
Config.DefaultTimeoutSeconds (default 30s), replacing the hard-coded 30s
guard in runner.RunJob.

- domain/storage: new fields, default 30, load-time normalization
- runner: RunJob takes an explicit timeout; StartOnly stays untimed so it
  keeps measuring launch latency only
- app: effectiveTimeout resolves under mu into runEnv, threaded to runJob;
  seam signature and validation updated; DisplayTimeout helper
- ui: Timeout entry in the job dialog, Default timeout in Settings, and a
  Timeout row in the details panel
- tests + docs (ARCHITECTURE, STANDARDS, ROADMAP, CHANGELOG) updated;
  version bumped to 0.12.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/domain/config.go

@@ -40,7 +40,10 @@ type Config struct {
 	NotifyOnFailure   bool          `json:"notify_on_failure,omitempty"`
 	ExecutionMode     ExecutionMode `json:"execution_mode,omitempty"`
 	OverlapPolicy     OverlapPolicy `json:"overlap_policy,omitempty"`
-	Paused            bool          `json:"paused,omitempty"`
+	// DefaultTimeoutSeconds is the run timeout applied to jobs that do not set
+	// their own Job.TimeoutSeconds. It carries the formerly hard-coded 30s guard.
+	DefaultTimeoutSeconds int  `json:"default_timeout_seconds,omitempty"`
+	Paused                bool `json:"paused,omitempty"`
 }
 
 // JobsFile is the on-disk shape of jobs.json. Wrapping the slice in a top-level