fix(hands): add max_concurrent + timeout_secs fields + hand timeout enforcement

M3-04/M3-05 audit fixes:
- HandConfig: add max_concurrent (u32) and timeout_secs (u64) with serde defaults
- Kernel execute_hand: enforce timeout via tokio::time::timeout, cancel on expiry
- All 9 hand implementations: add max_concurrent: 0, timeout_secs: 0
- Agent createClone: pass soul field through to kernel
- Fix duplicate soul block in agent_create command

crates/zclaw-hands/src/hand.rs

@@ -29,6 +29,29 @@ pub struct HandConfig {
     /// Whether the hand is enabled
     #[serde(default = "default_enabled")]
     pub enabled: bool,
+    /// Maximum concurrent executions for this hand (0 = unlimited)
+    #[serde(default)]
+    pub max_concurrent: u32,
+    /// Timeout in seconds for each execution (0 = use HandContext default)
+    #[serde(default)]
+    pub timeout_secs: u64,
+}
+
+impl Default for HandConfig {
+    fn default() -> Self {
+        Self {
+            id: String::new(),
+            name: String::new(),
+            description: String::new(),
+            needs_approval: false,
+            dependencies: Vec::new(),
+            input_schema: None,
+            tags: Vec::new(),
+            enabled: true,
+            max_concurrent: 0,
+            timeout_secs: 0,
+        }
+    }
 }
 
 fn default_enabled() -> bool { true }

crates/zclaw-hands/src/hands/browser.rs

@@ -153,6 +153,8 @@ impl BrowserHand {
                 })),
                 tags: vec!["automation".to_string(), "web".to_string(), "browser".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
         }
     }

crates/zclaw-hands/src/hands/clip.rs

@@ -256,6 +256,8 @@ impl ClipHand {
                 })),
                 tags: vec!["video".to_string(), "media".to_string(), "editing".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             ffmpeg_path: Arc::new(RwLock::new(None)),
         }

crates/zclaw-hands/src/hands/collector.rs

@@ -163,6 +163,8 @@ impl CollectorHand {
                 })),
                 tags: vec!["data".to_string(), "collection".to_string(), "scraping".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             client: reqwest::Client::builder()
                 .timeout(std::time::Duration::from_secs(30))

crates/zclaw-hands/src/hands/quiz.rs

@@ -492,6 +492,8 @@ impl QuizHand {
                 })),
                 tags: vec!["assessment".to_string(), "education".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             state: Arc::new(RwLock::new(QuizState::default())),
             quiz_generator: Arc::new(DefaultQuizGenerator),

crates/zclaw-hands/src/hands/researcher.rs

@@ -183,6 +183,8 @@ impl ResearcherHand {
                 })),
                 tags: vec!["research".to_string(), "web".to_string(), "search".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             client: reqwest::Client::builder()
                 .timeout(std::time::Duration::from_secs(30))

crates/zclaw-hands/src/hands/slideshow.rs

@@ -171,6 +171,8 @@ impl SlideshowHand {
                 })),
                 tags: vec!["presentation".to_string(), "education".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             state: Arc::new(RwLock::new(SlideshowState::default())),
         }

crates/zclaw-hands/src/hands/speech.rs

@@ -164,6 +164,8 @@ impl SpeechHand {
                 })),
                 tags: vec!["audio".to_string(), "tts".to_string(), "education".to_string(), "demo".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             state: Arc::new(RwLock::new(SpeechState {
                 config: SpeechConfig::default(),

crates/zclaw-hands/src/hands/twitter.rs

@@ -272,6 +272,8 @@ impl TwitterHand {
                 })),
                 tags: vec!["twitter".to_string(), "social".to_string(), "automation".to_string(), "demo".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             credentials: Arc::new(RwLock::new(None)),
         }

crates/zclaw-hands/src/hands/whiteboard.rs

@@ -195,6 +195,8 @@ impl WhiteboardHand {
                 })),
                 tags: vec!["presentation".to_string(), "education".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             state: std::sync::Arc::new(tokio::sync::RwLock::new(WhiteboardState {
                 canvas_width: 1920.0,