fix(runs): disable implicit lifetime cancellation

[drewstone]

Elapsed time alone must not end an accepted durable run.

• default BRIDGE_RUN_MAX_LIFETIME_MS and RunRegistry maxLifetimeMs to 0
• preserve explicit positive operator and caller deadlines
• document the opt-in emergency cap
• prove the default survives the former six-hour boundary

Proof:

• pnpm build
• pnpm exec vitest run tests/run-memory-bounds.test.ts tests/server-capabilities.test.ts tests/execution-timeout.test.ts: 22/22 passed
• full macOS suite: 1008/1043 passed; 16 existing platform-specific failures in jail, Docker path canonicalization, and Linux Pi isolation tests