fix(pi-workflow): bound host command execution

docs/pi-workflow/README.md

@@ -30,7 +30,7 @@ The managed flow is:
 4. Choose a fresh plan-seeded session, compacted current session, or unchanged current context.
 5. Implement with guarded file ownership.
 6. Remove prototype-only behavior.
-7. Run plan-approved verification commands and focused tests.
+7. Run plan-approved verification commands and focused tests. Each host command is terminated after three minutes so an interactive or stalled command cannot block the run indefinitely.
 8. Complete independent specification and standards review.
 
 The assistant must inspect the current run before each state-changing call and obtain the user's explicit Gate Decision. It must not infer approval.

docs/pi-workflow/design.md

@@ -403,6 +403,7 @@ Mutating Assignments run in the Workflow Run's worktree.
 - Mutating child sessions do not receive `bash` or other process-execution tools. Assignment-scoped file operations reject symlink traversal and require canonical containment beneath both the worktree root and the Assignment's owned path roots.
 - Plan-approved verification and generation commands run separately through a host executor using fixed executable/argument arrays, never agent-authored shell strings. The only accepted wrapper form is `env PI_OFFLINE=1 <executable> ...`; the executor unwraps it, sets that single variable, and applies the normal executable safety checks.
 - The host executor sets `PYTHONDONTWRITEBYTECODE=1` so Python-backed checks do not create out-of-scope `__pycache__` artifacts.
+- Every host command has a three-minute execution timeout and reports exit code `124` when terminated, preventing interactive or stalled commands from blocking a run indefinitely.
 - The engine records branch, HEAD, worktree identity, and Git diff state before and after every mutating Assignment and host command.
 - Out-of-scope changes, branch movement, commits, or worktree metadata changes invalidate the Assignment and open a Recovery Gate before more mutation starts.
 - The scheduler reserves capacity synchronously before launching children.