v0.1.3 — per-command timeouts to prevent harden hangs

Fix: all exec.Command calls in harden.go now use exec.CommandContext with hard timeouts (5-30s systemctl, 5-10s ss/nc/visudo, 120s apt-get). Prevents indefinite hang when systemctl restart ssh stalls.