feat(run): close bounded execution handoff gaps

[pacphi]

Summary

• thread strict, sanitized, bounded runtime-only dependency handoffs through the canonical ak run DAG
• enforce one absolute readiness-to-observe deadline per escalation attempt with progressive resource registration
• harden OpenCode response bounds, abort propagation, and Windows full-process-tree teardown
• make malformed/missing handoffs non-escalatable and cleanup uncertainty explicitly orphaned
• update ADR-0018, help, and README contracts

Verification

• pnpm run check
• pnpm run test:surface (26/26)
• focused execution suite (73 pass; 2 platform skips on macOS)
• focused handoff/privacy review: NO BLOCKER
• focused lifecycle/Windows cleanup review: NO BLOCKER
• focused OpenCode abort/state review: NO BLOCKER

Closes #76