fix(governance): honour policy timeout in shell execution — remove 60s cap (#28)

[jpleva91]

Summary

• Removes the unconditional 60-second cap applied in both runShellWithRTK and runShellRaw
• The governance engine (via engine.GetTimeout()) is now the sole source of truth for execution timeout — the value flows through unchanged
• The default agentguard.yaml bounded-execution policy sets 300s; this fix ensures that value is actually honoured

Root cause

Both shell execution paths silently overrode the caller-supplied timeout:

if timeout > 60*time.Second {
    timeout = 60 * time.Second  // governance policy value discarded
}

Operators who configured generous timeouts had no indication their policy was being ignored — the governance log showed the policy matched, but the actual enforcement happened at the hardcoded limit.

Test plan

• go build ./cmd/shellforge/ passes
• Manual: run a command that takes >60s — verify it is not killed early
• CI green

Closes #28

🤖 Generated with Claude Code