fix(hands): add max_concurrent + timeout_secs fields + hand timeout enforcement

M3-04/M3-05 audit fixes:
- HandConfig: add max_concurrent (u32) and timeout_secs (u64) with serde defaults
- Kernel execute_hand: enforce timeout via tokio::time::timeout, cancel on expiry
- All 9 hand implementations: add max_concurrent: 0, timeout_secs: 0
- Agent createClone: pass soul field through to kernel
- Fix duplicate soul block in agent_create command

crates/zclaw-hands/src/hands/quiz.rs

@@ -492,6 +492,8 @@ impl QuizHand {
                 })),
                 tags: vec!["assessment".to_string(), "education".to_string()],
                 enabled: true,
+                max_concurrent: 0,
+                timeout_secs: 0,
             },
             state: Arc::new(RwLock::new(QuizState::default())),
             quiz_generator: Arc::new(DefaultQuizGenerator),