A provider that stays alive but stops answering control requests kept each
provider-turn.start (or interrupt/steer) running forever. Leases expired but
nothing freed the worker, so four such effects stalled every thread on every
provider (#16636).

Each provider control call on the start path (session open, thread
load/resume, abandoned-turn recovery, turn start) is now bounded at two
minutes, so an unanswered start fails through the existing start-failure paths
and the run settles as failed. The worker also bounds process-bound effects at
twelve minutes as a backstop, so an unanswered interrupt, steer, or restart
frees its worker and goes through the normal retry/fail path. Agent turns are
unaffected: startTurn returns on acceptance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>