fix: resolve 17 P2 defects and 5 P3 defects from pre-launch audit

Batch fix covering multiple modules:
- P2-01: HandRegistry Semaphore-based max_concurrent enforcement
- P2-03: Populate toolCount/metricCount from Hand trait methods
- P2-06: heartbeat_update_config minimum interval validation
- P2-07: ReflectionResult used_fallback marker for rule-based fallback
- P2-08/09: identity_propose_change parameter naming consistency
- P2-10: ClassroomMetadata is_placeholder flag for LLM failure
- P2-11: classroomStore userDidCloseDuringGeneration intent tracking
- P2-12: workflowStore pipeline_create sends actionType
- P2-13/14: PipelineInfo step_count + PipelineStepInfo for proper step mapping
- P2-15: Pipe transform support in context.resolve (8 transforms)
- P2-16: Mustache {{...}} → \${...} auto-normalization
- P2-17: SaaSLogin password placeholder 6→8
- P2-19: serialize_skill_md + update_skill preserve tools field
- P2-22: ToolOutputGuard sensitive patterns from warn→block
- P2-23: Mutex::unwrap() → unwrap_or_else in relay/service.rs
- P3-01/03/07/08/09: Various P3 fixes
- DEFECT_LIST.md: comprehensive status sync (43/51 fixed, 8 remaining)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/zclaw-kernel/src/kernel/hands.rs

@@ -201,7 +201,17 @@ impl Kernel {
 
         let context = HandContext::default();
         let start = std::time::Instant::now();
-        let hand_result = self.hands.execute(hand_id, &context, input).await;
+
+        // P2-02: Apply timeout to execute_hand_with_source (same as execute_hand)
+        let timeout_secs = self.hands.get_config(hand_id)
+            .await
+            .map(|c| if c.timeout_secs > 0 { c.timeout_secs } else { context.timeout_secs })
+            .unwrap_or(context.timeout_secs);
+
+        let hand_result = tokio::time::timeout(
+            std::time::Duration::from_secs(timeout_secs),
+            self.hands.execute(hand_id, &context, input),
+        ).await;
         let duration = start.elapsed();
 
         // Check if cancelled during execution
@@ -217,6 +227,23 @@ impl Kernel {
         self.running_hand_runs.remove(&run_id);
 
         let completed_at = chrono::Utc::now().to_rfc3339();
+        // Handle timeout result
+        let hand_result = match hand_result {
+            Ok(result) => result,
+            Err(_) => {
+                // Timeout elapsed
+                cancel_flag.store(true, std::sync::atomic::Ordering::Relaxed);
+                run.status = HandRunStatus::Failed;
+                run.error = Some(format!("Hand execution timed out after {}s", timeout_secs));
+                run.duration_ms = Some(duration.as_millis() as u64);
+                run.completed_at = Some(completed_at);
+                self.memory.update_hand_run(&run).await?;
+                return Err(zclaw_types::ZclawError::Internal(
+                    format!("Hand '{}' timed out after {}s", hand_id, timeout_secs)
+                ));
+            }
+        };
+
         match &hand_result {
             Ok(res) => {
                 run.status = HandRunStatus::Completed;