fix(terminal): always complete hiddenExec on timeout/error/cancel (Fixes #1180)

[yoruuuchan]

Fixes #1180

Where it actually hangs

Tools.System.terminal.hiddenExec creates a JS Promise that only settles when the Kotlin tool callback returns. That callback ends in LocalTerminalProvider.executeHiddenCommand inside the terminal submodule. Two phases there were not bounded by the caller deadline, and one cleanup could not be cancelled:

1. getOrCreateHiddenExecShell() ran before withTimeout(timeoutMs): shell startup, readiness (fixed internal 30s) and the global creation mutex were not covered by the caller budget.
2. The command was written with structured withContext(Dispatchers.IO). When a hidden shell stops draining its pipe, that write blocks a thread, and coroutine cancellation still has to join the child before the call can return.
3. On timeout the shell was retired asynchronously, so the next call with the same executorKey could wait on a half-closed shell.

When a hidden shell stops draining its pipe, (2) leaves the call pending forever — no timeout, no error: the returned Promise never resolves or rejects. QQbot reproduces this reliably when it starts its background gateway, but the defect is in the generic hidden executor chain (also used by code_runner and linux_ssh), not in that caller.

Fix

• terminal submodule (see dependent PR fix(terminal): bound hidden exec lifecycle so calls always complete OperitTerminalCore#6): prepare/queue/write/read all run inside one caller deadline; the blocked write is cancellable instead of joined; failed/timed-out/cancelled executors are retired through an idempotent close that destroys the process before closing the writer; a queued call re-resolves executorKey when the previous owner retired the shell; processes whose creation raced with cancellation are destroyed.
• StandardTerminalCommandExecutor: logs request and completion with executorKey, state and exitCode, so timeout / error / cancellation is diagnosable.
• SystemToolPromptsInternal and examples/types/*.d.ts: timeout_ms documented as the whole hidden execution lifecycle (initialization + queueing + execution), and a timed-out or failed active executor is retired instead of reused.
• CI: :terminal:testDebugUnitTest now runs in android-tests.yml and pr-check.yml.

No QQbot-specific workaround. code_runner and linux_ssh keep the same API and the same result shape ({ output, exitCode, executorKey, timedOut }).

Verification

• ./gradlew :terminal:testDebugUnitTest — 13 hidden-exec lifecycle tests pass on JDK 21 (verified on JDK 17 as well).
• Same tests against the unfixed dev implementation: readiness, creation-mutex and blocked-write cases fail with a wall-clock TimeoutException, reproducing [Bug] ToolPkg hiddenExec 调用永久挂起：qqbot「开启监听」卡死（Operit 1.12.1） #1180's permanent wait.
• ./gradlew :app:compileDebugKotlin passes with the updated submodule pointer (JDK 21).
• Known boundaries: :app:testDebugUnitTest cannot compile on dev either (pre-existing DeepseekProviderMediaRoleTest / XaiProviderReasoningTest errors — reproduced on a clean dev tree), and a full assembleDebug needs a host nmake for MNN FlatBuffers that this machine does not have.

Dependency

The submodule PR AAswordman/OperitTerminalCore#6 must be merged first: this branch points terminal at the fix commit, which currently only exists in the fork PR. CI submodule checkout will fail until it is merged.