fix(hands): add max_concurrent + timeout_secs fields + hand timeout enforcement

M3-04/M3-05 audit fixes:
- HandConfig: add max_concurrent (u32) and timeout_secs (u64) with serde defaults
- Kernel execute_hand: enforce timeout via tokio::time::timeout, cancel on expiry
- All 9 hand implementations: add max_concurrent: 0, timeout_secs: 0
- Agent createClone: pass soul field through to kernel
- Fix duplicate soul block in agent_create command

desktop/src-tauri/src/kernel_commands/agent.rs

@@ -26,6 +26,8 @@ pub struct CreateAgentRequest {
     pub description: Option<String>,
     #[serde(default)]
     pub system_prompt: Option<String>,
+    #[serde(default)]
+    pub soul: Option<String>,
     #[serde(default = "default_provider")]
     pub provider: String,
     #[serde(default = "default_model")]
@@ -88,6 +90,10 @@ pub async fn agent_create(
         .with_max_tokens(request.max_tokens)
         .with_temperature(request.temperature);
 
+    if let Some(soul) = request.soul {
+        config = config.with_soul(soul);
+    }
+
     if let Some(workspace) = request.workspace {
         config.workspace = Some(workspace);
     }