fix(hands): add max_concurrent + timeout_secs fields + hand timeout enforcement

M3-04/M3-05 audit fixes:
- HandConfig: add max_concurrent (u32) and timeout_secs (u64) with serde defaults
- Kernel execute_hand: enforce timeout via tokio::time::timeout, cancel on expiry
- All 9 hand implementations: add max_concurrent: 0, timeout_secs: 0
- Agent createClone: pass soul field through to kernel
- Fix duplicate soul block in agent_create command

crates/zclaw-hands/src/hand.rs

@@ -29,6 +29,29 @@ pub struct HandConfig {
     /// Whether the hand is enabled
     #[serde(default = "default_enabled")]
     pub enabled: bool,
+    /// Maximum concurrent executions for this hand (0 = unlimited)
+    #[serde(default)]
+    pub max_concurrent: u32,
+    /// Timeout in seconds for each execution (0 = use HandContext default)
+    #[serde(default)]
+    pub timeout_secs: u64,
+}
+
+impl Default for HandConfig {
+    fn default() -> Self {
+        Self {
+            id: String::new(),
+            name: String::new(),
+            description: String::new(),
+            needs_approval: false,
+            dependencies: Vec::new(),
+            input_schema: None,
+            tags: Vec::new(),
+            enabled: true,
+            max_concurrent: 0,
+            timeout_secs: 0,
+        }
+    }
 }
 
 fn default_enabled() -> bool { true }