feat: make AST subprocess timeout injectable for test coverage

[rhuanbarreto]

Context

From PR #452 review: runAstSubprocess's AST_SUBPROCESS_TIMEOUT_MS (15s) timeout branch has no test coverage because the hardcoded constant makes it impractical to test without real-time waits.

Proposal

Add an optional timeoutMs parameter to runAstSubprocess() (defaulting to the module constant) so tests can inject a small value and exercise the timeout → kill → throw path deterministically.

// Before
export async function runAstSubprocess(cmd: string[]): Promise<...>

// After
export async function runAstSubprocess(cmd: string[], timeoutMs = AST_SUBPROCESS_TIMEOUT_MS): Promise<...>

Then add a test:

test("throws after the timeout and kills the subprocess", async () => {
  await expect(
    runAstSubprocess([process.execPath, "-e", "setTimeout(() => {}, 10000)"], 50)
  ).rejects.toThrow(/timed out/u);
});

References

• PR feat: ast-aware rule context (ctx.ast) for TS/JS/Python/Ruby #452 review threads: injectable timeout + missing timeout test coverage
• Files: src/engine/ast-support.ts, tests/engine/ast-support.test.ts