fix(platform): bound Windows shell-outs so wire status/up/doctor can't hang (#284.1)

[laulpogan]

Part 1 of #284 (Willard's Windows report).

Summary

wire status, wire up, and wire doctor hung indefinitely when the Windows process-enumeration shell-outs they rely on wedged. On Willard's box, 254 stale wire.exe processes under heavy WMI contention made Get-CimInstance Win32_Process legitimately slow; a corrupted CIM repository would hang it outright. With no timeout, every CLI surface that ran a process probe blocked forever.

Fix

A new crate::platform::run_with_timeout(cmd, dur):

1. Spawn the child with piped stdout/stderr.
2. Hand wait_with_output to a reader thread that pushes the result through an mpsc::channel.
3. Main thread recv_timeouts.
4. On timeout, kill the wedged child by PID via the OS-native tool — taskkill /F /T /PID on Windows, kill -9 on POSIX — so the reader thread unblocks and the child tree exits with the wrapper.

Applied to every Windows shell-out in this module:

Call	What	Used by
process_alive	tasklist /FI "PID eq <pid>"	wire status, doctor health checks, daemon liveness
find_processes_by_cmdline	PowerShell Get-CimInstance Win32_Process	wire status orphan-pid scan, wire upgrade daemon kill, identity-collision check (#247.4)
pid_cmdline	PowerShell Get-CimInstance Win32_Process filtered to one pid	orphan-pid annotation in wire status

Default timeout 5s (well past the ≤100ms a healthy host needs for any of these probes), overridable via WIRE_PLATFORM_TIMEOUT_SECS. On timeout each call falls through to its existing tool-error fallback (false for liveness, empty Vec for the enumerator, None for cmdline) — same shape the old Err(_) | Ok(non-success) arms produced, so callers don't need to handle a new "timed out" state. wire status / wire doctor now return promptly with whatever local state is readable instead of blocking on a wedged probe.

POSIX shell-outs (pgrep, kill, /proc/<pid> reads) are unchanged — they're either pure-fs reads or known-fast tool calls with their own timeouts.

Tests

3 new in platform::tests, all green on x86_64-pc-windows-msvc (rustc 1.96.0):

• run_with_timeout_returns_some_on_fast_command — echo / cmd.exe /C echo completes inside 5s and stdout is captured.
• run_with_timeout_returns_none_and_kills_on_slow_command — sleep 60 / Start-Sleep -Seconds 60 is killed inside a 500ms timeout, and the wrapper returns inside 10s (not 60s). Verifies the kill actually fires.
• platform_shell_timeout_default_is_5s — env var override works and the default is 5s.

Full lib suite: 489 passed; 0 failed; 7 ignored.

Out of scope (left for follow-ups)

• The "relay-stream long-poll itself wedges in the daemon" failure mode that produced Willard's daemon-stream: error error decoding response body: operation timed out log spam is a daemon-side bug, not a CLI hang — separate issue.
• wire upgrade's prebuilt-download hang (no progress bar, just silent hang when crates.io + github are both reachable) is Windows: status/up/doctor + upgrade hang, SessionStart wait-loop pileup (254 procs), and wire_send peer_unknown on VERIFIED peer #284.3.
• The until wire status | grep daemon_running:true; do sleep 3; done SessionStart loop that piled up the 254 wire.exe procs is Windows: status/up/doctor + upgrade hang, SessionStart wait-loop pileup (254 procs), and wire_send peer_unknown on VERIFIED peer #284.2. With this PR wire status returns promptly even with that loop still running, but the loop should also become bounded so a never-healthy state doesn't accumulate procs forever.

Stack

Stacks on top of #294 (Windows test/clippy hygiene). Rebase onto main once #294 lands.

Sibling Windows-cluster PRs already open: #296 (#284.5 stale relay.lock reclaim), #297 (#247.4 Windows identity-collision adapter).

Test plan

• cargo fmt --check clean on Windows.
• cargo clippy --all-targets -- -D warnings clean on Windows.
• cargo test --lib 489/0/7 on Windows.
• CI green (install-smoke-windows, demo, docs-lint).
• Manual repro: stage a host with hundreds of wire.exe procs (or run the wrapper directly against powershell.exe Start-Sleep 60 via the new unit test), confirm wire status / wire doctor finish promptly.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying wireup-landing with    Cloudflare Pages

Latest commit:	f2d19b6
Status:	✅  Deploy successful!
Preview URL:	https://ecb651c8.wireup-landing.pages.dev
Branch Preview URL:	https://fix-284-1-bounded-status-up.wireup-landing.pages.dev

View logs