[elezar]

Stacked on #5450. Review that PR first; this diff is against its branch.

Summary

A hung CLI call in a conformance lane showed only nextest's generic TIMEOUT, with no command name or output, and the gateway log tail began after the stalled test.

• Time budget. The runner exports the per-test limit as OPENSHELL_TEST_TIMEOUT_SECS, from the same constant as the nextest profile and the program's --timeout. testkit caps its CLI, sandbox exec, sandbox wait and poll timeouts to the time left minus 5 s, so a stuck step fails with its own error. Cleanup keeps its own timeouts. Without the variable, nothing is capped.
• CLI output. A command that times out reports its command name and the output it printed so far. A command that takes over 10 s, exits non-zero, or is still running (every 30 s) is reported on stderr. Fast successful commands print nothing.
• Gateway logs. The k3s diagnostics collect gateway logs from the run's start time (--since-time, written by the runner in the guest), with a 30 minute fallback, keeping the first 64 KiB and last 512 KiB.

Related Issue

Part of #5333. Not covered here, so the issue stays open:

• The log window starts at the beginning of the run, not at the failing test.
• junit.xml is still lost on a run-level timeout; that fits test(runner): follow-ups to running a prebuilt testkit program on runner rows #5416.

Testing

• cargo fmt --check, cargo clippy --all-targets -- -D warnings and cargo test pass for tests/testkit and tests/runner.
• New unit tests cover the budget cap and CLI timeout reporting.
• collect-k3s.sh was only syntax-checked (bash -n), and no e2e lane was run.