Enforce Firecracker runtime timeout via host watchdog and clarify limit semantics

[Copilot]

timeoutMs was only applied to the initial VSOCK connect path, leaving post-connect guest execution able to block indefinitely. This change closes that gap while preserving existing memoryMb/cpuLimit wiring to Firecracker machine-config.

• Execution timeout enforcement (host-side watchdog)

  • Added bounded VSOCK frame reads in FirecrackerOrchestrator::wait_and_teardown.
  • Applied a rolling read timeout plus absolute elapsed-time check against timeoutMs.
  • On timeout, host now force-terminates the Firecracker process and returns an execution-timeout error.

• Failure semantics

  • Differentiated disconnect (UnexpectedEof) from watchdog timeout (TimedOut) during stream processing.
  • Kept teardown behavior centralized through existing cleanup paths.

• Documentation clarity (limit ownership)

  • Updated docs to explicitly state:
    • memoryMb and cpuLimit map to Firecracker machine-config.
    • timeoutMs is enforced by a host watchdog during runtime execution.

stream.set_read_timeout(Some(Duration::from_millis(IO_POLL_TIMEOUT_MS)))?;

if start_time.elapsed().as_millis() > (timeout_ms as u128) {
    return Err(std::io::Error::new(
        std::io::ErrorKind::TimedOut,
        "Execution timed out",
    ));
}