fix(cypher): add a wall-clock execution deadline to abort runaway queries (#601)

[DeusData]

Problem (#601)

An unbounded whole-graph OPTIONAL MATCH — or a GROUP BY that yields roughly one group per node — does O(bindings × groups) work in execute_return_agg and can run for minutes on a large graph (reporter: 93k nodes / 488k edges) before producing a single row. The existing 100k row ceiling never fires because no rows are produced, so query_graph just hangs — no partial result, no error, the caller waits indefinitely.

MATCH (a)
OPTIONAL MATCH (a)-[:CALLS]->(b)
RETURN a.qualified_name, count(b)

Fix

Add a monotonic wall-clock deadline alongside the row ceiling (same guard philosophy, complementary trigger):

• Arm a budget (default 30s) at query entry via cbm_now_ms().
• Check it — throttled, every 1024 iterations — in the three hot loops that can blow up before rows exist: the initial node scan, relationship expansion (expand_pattern_rels), and aggregation grouping (execute_return_agg).
• On expiry, abort and return a clear, actionable error instead of hanging:

  query exceeded the execution time limit — narrow the pattern with a WHERE filter, use a directed MATCH instead of an unbounded OPTIONAL MATCH, or add LIMIT

State is _Thread_local (per-query, concurrency-safe). No new MCP tool / env var / config knob — a hardcoded budget, consistent with the existing hardcoded row ceiling.

Tests (reproduce-first)

• cypher_exec_deadline_aborts_runaway_query_issue601 — RED-verified: with enforcement neutralized the query completes (rc==0) exactly as today; with the fix it aborts with the time-limit error and 0 rows.
• cypher_exec_deadline_allows_normal_query_issue601 — the default budget does not false-positive on a normal small query.

A thread-local test hook (cbm_cypher_test_set_deadline_ms) forces the budget so the guard is covered deterministically without needing a giant graph.

Full cypher (152) and mcp (165) suites pass; lint-ci clean.

Closes #601.