feat: enforce lifecycle.startup_timeout for MCP/LSP toolset startup

[dgageot]

What

Enforces lifecycle.startup_timeout for MCP/LSP toolset startup. Until now this config field (and its strict-profile 30s default) was parsed and validated but never acted on — EffectiveStartupTimeout() had no callers, so a server that hung mid-initialize would block startup indefinitely.

Why

The MCP clientConnector.Connect deliberately detaches its context with context.WithoutCancel (the session must outlive the request that triggered it). A consequence is that the initialize handshake has no deadline of its own: a server that accepts the connection but never completes initialize wedges the startup attempt forever, and startup_timeout could not rescue it because nothing consumed the value.

How

• Add StartupTimeout to lifecycle.Policy and wire EffectiveStartupTimeout() into PolicyFromConfig.
• Enforce it in Supervisor.connect() by racing Connect against a timer rather than a ctx deadline (a deadline would be stripped by WithoutCancel). On expiry, Start returns ErrInitTimeout and the toolset stays Stopped so the runtime retries on the next turn.
• Guarantee at most one Connect is ever in flight: a timed-out Connect goroutine is left running and recorded in inflightConnect; the next Start adopts it and Stop reaps it. This is required because the MCP transport shares one underlying client across Connect calls — two overlapping connects would race on the shared session (a late one could clobber/close a newer one). An adopted flag under the mutex ensures the resulting session is adopted-or-closed exactly once.

Scope

startup_timeout bounds only the initial Start, not background watcher reconnects (which already have their own restart/backoff budget). strict → 30s default; other profiles → 0 (no timeout); explicit value always wins.

Tests

New supervisor tests (all pass under -race): timeout returns ErrInitTimeout with a single Connect; the next Start adopts a late-completing connect; Stop reaps and closes a late connect. New PolicyFromConfig test covers the nil/resilient/strict/explicit cases.

[docker-agent]

Assessment: 🟡 NEEDS ATTENTION

This PR correctly implements the startup-timeout enforcement mechanism for MCP/LSP toolset startup with a well-thought-out single-inflight-connect guarantee. Two findings worth the author's attention are filed as inline comments.

[dgageot]

Addressed both review findings, rebased on origin/main, and verified locally (task lint clean, go test -race ./pkg/tools/lifecycle/... and task build pass).

• [MEDIUM] The timed-out in-flight Connect goroutine now runs with context.WithoutCancel(ctx), so a cancellation of the first caller's context can't surface as a stale context.Canceled to a later adopting Start. Added TestSupervisor_StartAdoptsLateConnectAfterFirstCtxCancelled.
• [LOW] The adopt path now closes the session defensively when a connector returns both a non-nil session and a non-nil error, rather than discarding it.