Add a bounded, killable run with stdin to Executor (#129)

AGENTS.md

@@ -489,8 +489,9 @@ Where the crate handles key material or secrets:
 `test-support` exists only to expose test-only fixtures across the
 crate boundary, since `cfg(test)` is invisible to dependents: the
 account fixtures (`Principal::Fixture`, `ServiceAccount::Fixture`),
-payload fixtures, and the synthetic image archive builder in
-`image::test_support`. Enable it in a dependent's `[dev-dependencies]`
+payload fixtures, the synthetic image archive builder in
+`image::test_support`, and the recording, scriptable executor in
+`executor::test_support`. Enable it in a dependent's `[dev-dependencies]`
 only — never under `[dependencies]`, so the fixtures stay out of every
 release build.
 

Cargo.toml

@@ -24,7 +24,10 @@ hostname = "0.4"
 num-bigint = "0.4.5"
 rustls-pki-types = "1"
 rustls-webpki = { version = "0.103", default-features = false, features = ["aws-lc-rs", "std"] }
-rustix = { version = "1", features = ["fs", "process"] }
+# `event` adds `poll`, which `Executor::run_with_input` multiplexes the child's
+# stdin, stdout and stderr through so each is bounded and the child can be
+# killed at a deadline; std offers no readiness wait or read timeout on a pipe.
+rustix = { version = "1", features = ["event", "fs", "process"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"

README.md

@@ -169,8 +169,10 @@ The `test-support` feature exposes test-only account fixtures
 (`Principal::Fixture` / `ServiceAccount::Fixture`), payload fixtures such as
 `payload::widen_envelope_blocks`, and `image::test_support` — a builder for
 synthetic image archives the image validator accepts, and a classifier that
-holds any image archive against a declaration — so a **dependent** crate's
-tests can construct them across the crate boundary. With
+holds any image archive against a declaration — and
+`executor::test_support::RecordingExecutor`, which records every call it
+receives and answers each from a script, so a **dependent** crate's tests can
+construct them across the crate boundary. With
 `package::prepare_sign_finalize` and a test key minted per test, those
 archives become genuinely signed format-6 packages that pass every final
 check; `tests/signed_fixtures.rs` builds one through the public API alone.