fix(buzz-acp): distinguish idle vs hard-cap timeout, dead-letter hard kills immediately

[wpfleger96]

Summary

Hard-cap timeouts (wall-clock limit) were mislabeled as idle-timeout "inactivity" and retried up to 10× — each cycle re-running the same >1h task from a fresh session before dying again, burning ~10h of compute on a single message. Additionally, the queue's in-flight backstop was hardcoded to the old 3600s cap + 100s buffer, meaning a legitimate 2h turn would get force-released at ~62 min while still running.

Five coupled fixes:

• Plumb TimeoutKind { Idle, Hard } through PromptOutcome::Timeout so every downstream site can distinguish which clock fired. Split the combined IdleTimeout | HardTimeout cancel-drain arm in pool.rs to carry the correct kind. Observer outcome_label now emits "idle_timeout" or "hard_timeout" instead of the ambiguous "timeout".

• Dead-letter hard-cap kills immediately in handle_prompt_result without calling queue.requeue(). Hard-cap failure is deterministic — a fresh session reproduces the same death. Idle timeout keeps its current retry behavior (may be a transient provider stall). The user-facing message now reads "Agent turn exceeded the maximum duration ({N}s)" instead of the misleading "Agent session timed out due to inactivity".

• Raise max_turn_duration default 3600s → 7200s so genuinely long turns (heavy implementation work) have headroom. Idle stays at 900s, preserving the idle < max_turn invariant and the real hang detector.

• Derive in-flight deadline from max_turn_duration instead of a hardcoded IN_FLIGHT_DEADLINE_SECS = 3700. The queue's EventQueue now carries a configurable in_flight_deadline field set to max_turn_duration + 100s at the prod construction site. Tests keep the default (7300s) via EventQueue::new(); prod calls .with_in_flight_deadline(). Adds DEFAULT_MAX_TURN_DURATION_SECS constant to config.rs and wires it into all test fixtures and the clap default_value_t.

• Validate max_turn_duration upper bound at the config boundary (MAX_TURN_DURATION_CEILING_SECS = 604_800, 7 days). Rejects values above the ceiling with a ConfigError, preventing arithmetic overflow in the in-flight deadline derivation (max_turn + 100). The timeout requeue test (hard_timeout_not_requeued_idle_timeout_is_requeued) now asserts queued event counts via queued_event_count(), not just channel-key presence, verifying that idle timeout preserves events and hard timeout drops them.

Files changed

• crates/buzz-acp/src/pool.rs — TimeoutKind enum, split cancel-drain arm, outcome_label branching
• crates/buzz-acp/src/lib.rs — handle_prompt_result hard-cap divert, death_message / outcome_label / dead-letter reason split, prod EventQueue construction with .with_in_flight_deadline(), hardened timeout requeue test with real event batch and event-count assertions
• crates/buzz-acp/src/config.rs — DEFAULT_MAX_TURN_DURATION_SECS and MAX_TURN_DURATION_CEILING_SECS constants, upper-bound validation with ConfigError, default_value_t on clap arg, boundary tests
• crates/buzz-acp/src/queue.rs — in_flight_deadline field on EventQueue, with_in_flight_deadline() builder, queued_event_count() test accessor, replaced all IN_FLIGHT_DEADLINE_SECS usage with instance field, invariant tests