ca-pi: harden bridge.ts failure paths — killTree deadline + ready rejection guard (reliability-001/003)

[SUaDtL]

Branch: feat/pi-support · Tribunal run 2026-07-17-pi-support-branch · Finding: findings/reliability/reliability-001.json, reliability-003.json (group bridge-hardening)
bridge.ts:302-335 win32 taskkill spawnSync has no timeout/fallback/settle deadline (wedge). bridge.ts:172-199 ready=validatePaths() unhandled until first call() (crash).

[SUaDtL]

Verified against PR #313 head 9ed248f4: bridge.ts bounds Windows taskkill with WINDOWS_TASKKILL_TIMEOUT_MS, force-settles calls whose child never emits close, and attaches an immediate rejection handler to constructor-time path validation. bridge.test.ts directly covers the failed-kill settle deadline and proves a rejecting validatePaths() causes no unhandledRejection while a later call still fails with the original validation error. This finding is implemented on #313, which now carries Closes #319.