fix(supervisor): bound provider install by dispatch deadline

[mfw78]

What

Wraps both ProviderKind::install call sites (revive and boot) in the dispatch deadline, so a hung provider install fails instead of parking the sweep, and with it all dispatch.

Part of #94

Why

A hung install in revive parks the sweep forever because the sweep runs inline (dispatch.rs). Bounding install_provider by the seed's event_deadline closes that hole and applies the same bound at the boot call site.

This is a maintainer-approved change to the ProviderKind::install contract: the deadline plus cancel-safety requirement is now documented directly on the trait method. Because install spans instantiation, guest init, and extension wiring rather than a single guest call, a timeout can drop the future mid-flight and must leave no half-registered actor in the extension service. Every downstream ProviderKind impl now has to uphold that cancel-safety contract. videre::VenueAdapterKind is the single downstream impl that adapts to it.

Testing

cargo nextest run -p nexum-runtime: 434 tests run, 434 passed, 0 skipped, including the two new deadline tests a_hanging_provider_install_fails_by_deadline and a_hanging_provider_install_refuses_the_boot_by_deadline, both under start_paused = true asserting the install rides the seed's deadline rather than any other timer.

AI Assistance

implement claude-fable-5, red-team claude-opus-5, PR claude-sonnet-5.