feat(client): add per-call task deadlines

[bokelley]

Summary

• add a typed TaskOptions deadline to every single-agent task and workflow method
• apply one absolute budget across discovery, capability/signing preflight, dispatch, validation, and postflight without changing transport timeouts
• attach exact idempotency recovery metadata when a timed-out mutation reached MCP/A2A dispatch
• preserve external cancellation and transport timeout behavior, including Python 3.10

Multi-agent fan-out is intentionally deferred because one timeout exception cannot safely represent per-seller mutation outcomes.

Verification

• uv run pytest -q — 7165 passed, 77 skipped, 9 deselected, 1 xfailed
• Python 3.10 isolated TaskOptions suite — 21 passed
• make lint typecheck test-type-checks
• expert code review: approved
• expert protocol review: approved

Addresses the TaskOptions follow-up in #1031.

[aao-secretariat]

Ladon verdict: Approve

Approve — additive per-call TaskOptions deadline across single-agent methods with mutation-recovery metadata on ADCPTimeoutError.

Checked against decision table top-down:

• Row 1 (critical/high): no critical or high findings. Only a single low finding (client.py:1288 — post-deadline guard confirmed safe).
• Row 2 (gated_paths + not APPROVED): gated_paths is false, so does not fire.
• Row 3 (deleted high-risk path): all high-risk reasons are (modified), none (deleted).
• Row 4 (medium data-loss/schema/infra): no medium findings.
• Row 5 (high_risk modified + medium finding): high_risk is true and files are modified, but there are zero medium findings, so does not fire.
• Row 6 (sticky escalate): no prior decision.
• Row 7 (no-auto-approve team): no team match.
• Row 8 (≥3 medium): zero medium findings.
• Falls through to Row 9 → approve.

Repo-specific gates verified clean: additive public surface under correct feat: prefix (no breaking semver signal needed), no generated-code hand-edits, no forward-compat discriminated-union regression, no credentials in ctx_metadata, import layering intact, CI gates armed (no disabled tests / blanket type-ignore / dropped ruff rules). Transport timeout stays separate; external cancellation and inner transport TimeoutError are re-raised with original cause; recovery stamped only once dispatch is marked mutating; deadline/recovery state is client-token-scoped for concurrency isolation.

No blocking findings.