Bound native cargo builds and individual WASI tests with cancellable deadlines

PROTOCOL.md

@@ -421,6 +421,20 @@ builds `/plugins/notes/source/`:
    {"passed", "failed", "output"}, "warnings"}`. If a step fails, it returns
    an error with the compiler or test output.
 
+- Optional `timeout_secs` is an integer of at least 1, default **900** (not
+  null or unlimited). The wall-clock budget starts when the build acquires its
+  mutex, excluding queue time, and covers tests and release compilation together.
+  On expiry, cargo and its descendant process group are killed and the mutex is
+  released. Error -32004 has reason/message `timeout`, with `data.reason`,
+  `data.elapsed_secs`, `data.step` (`tests` or `release build`), `data.tests`,
+  and `data.output` containing the last 50 output lines.
+- Optional `test_timeout_secs` is an integer of at least 1, default **120**.
+  Each WASI test instance has this wall-clock budget. On expiry, the instance
+  is killed, its named test fails with `timed out after N s`, and remaining
+  tests continue. The overall build budget still applies.
+- Cancellation kills cargo's process group, including build scripts and test
+  runners, before releasing the build mutex. An attached build also stops when
+  its caller ends (under the normal process stopping deadline).
 - A call to `cargo.build` gets a process ID, a folder in `/proc`, and journal
   entries, like other calls.
 - `/plugins/cargo/sdk/` shows the source of the SDK. The dependency