fix: bound MCP tool observation windows - #56

Summary

• bound assistant-visible MCP observation to a shared 60-second budget across workspace readiness, process start acknowledgement, and process observation
• keep Agent-tracked processes independent of MCP request lifetime and return recoverable process state instead of approaching the external ~300s deadline
• make build/template provisioner logs cursor-based with bounded waits, job status, completion, and pagination state
• add a 75-second Remote MCP safety watchdog as a last-resort guard for any handler that misses the 60-second contract
• document the behavior directly in MCP tool descriptions/schemas and cover the published tools/list contract in E2E tests

Validation

• focused codersdk/toolsdk timeout/process/log tests: pass
• coderd/mcp alias/schema compile tests: pass
• go test ./agent/agentproc -count=1: pass
• go vet ./codersdk/toolsdk ./coderd/mcp: pass
• coder-slim_linux_amd64 build: pass
• git diff --check: pass
• full MCP/toolsdk integration and golden generators are locally blocked by missing /var/run/docker.sock
• full golangci-lint was killed with exit 137 by workspace resource pressure; CI should run it with normal runner resources

Behavior contract

The 60-second limit is an MCP observation budget, not a process execution timeout. Durable processes and provisioner jobs continue independently. Assistants are instructed in the MCP schema to recover with process_output/process_list or cursor-based log reads rather than re-running work.