hive-c0re: bound the read-only container listing and systemctl status calls

priv_client::list_containers now waits at most 30s (LIST_WAIT) for
hive-priv's `nixos-container list`, via the existing `within` helper. Its
periodic callers (crash_watch, agent_sockets, swarm_agent_status, wanted,
mcp_sockets, swarm_status via container_view) already treat an Err as a
skipped cycle, so a hung listing no longer stops their loops for good.

lifecycle::is_running / unit_state run `systemctl is-active` with
kill_on_drop and a 10s timeout (IS_ACTIVE_TIMEOUT); a timeout warns and
reads as not-running / UnitState::Other, the same as a systemctl that
could not be spawned. The new lifecycle::running_state returns None for
that case, and crash_watch keeps the agent's previous observation on None
so a hung systemctl is neither reported as a crash nor as a recovery.

`call` itself and every mutating op (start/stop/destroy/send-snapshot/
daemon-reload) stay unbounded.

Closes #5061

docs/agent-lifecycle/config-changes.md

@@ -372,8 +372,11 @@ swarm lifecycle notices instead (`swarm_notices::notify`). Variants
   tombstone, three `POLL_INTERVAL`s — closes the race where a
   lifecycle op finishes between two crash-watch polls and the
   container shows briefly as "stopped without transient" before
-  the next start). The root agent escalates to the operator, who
-  starts it again from the dashboard.
+  the next start). When `systemctl is-active` fails or runs past its
+  10s bound on a poll, the container keeps its previous state for that
+  poll, so an unreadable unit never counts as a crash.
+  The root agent escalates to the operator, who starts it again from
+  the dashboard.
 - `NeedsUpdate { agent }` — sub-agent's recorded flake rev is
   stale. The operator rebuilds it from the dashboard.