Stop stalled execution agents on idle timeout

Why: prevent silent provider stalls from consuming the full execution timeout

Evidence: 57 focused tests, configuration validation, 401-test governance regression, and diff check

Impact: adds backward-compatible idle_timeout_seconds and fail-stop process supervision

Refs: U5 runtime acceptance; docs/superpowers/plans/2026-10-15-project-agent-execution.md

AGENT-EXECUTION.md

@@ -8,7 +8,9 @@ parser accepts exactly one `agent-execution` fenced block.
 U3's execution controller and U4's project wiring are integrated. This file is
 the execution-routing authority for implementation, repair, test, and review.
 Installed CLI identity stays unproven until a host runs the U5 probes one
-profile at a time.
+profile at a time. A provider that makes no successful stdin write or
+stdout/stderr read for `idle_timeout_seconds` is stopped before
+`timeout_seconds`.
 
 ```agent-execution
 schema: agent-execution/v1
@@ -19,6 +21,7 @@ execution:
   fallback_to_host: all-unavailable
   max_parallel: 3
   timeout_seconds: 7200
+  idle_timeout_seconds: 600
   summary_bytes: 16384
   raw_output_bytes: 10485760