feat(runtime): adapter-declared idle_timeout_override — primitive #2 of 6

[HongmingWang-Rabbit]

Summary

Capability primitive #2 of 6 (task #117), stacked on the foundation in PR #2137. The first cross-cutting capability where the adapter actually displaces platform behavior end-to-end.

The bug PR #2128 patched at the wrong layer: claude-code's streaming session can legitimately go silent for 8+ minutes during synthesis + slow tool calls. The platform's hardcoded 5min idle timer in `a2a_proxy.go` cancels it mid-flight. PR #2128 made the timer env-tunable cluster-wide, but ops can't pick a single value that works for both fast langgraph + slow claude-code synthesis. This PR fixes it at the right layer: the adapter declares its own window and the platform honors it per-workspace.

Wire shape (Python → Go)

```
POST /registry/heartbeat
{
"workspace_id": "...",
...
"runtime_metadata": {
"capabilities": {"heartbeat": false, "scheduler": false, ...},
"idle_timeout_seconds": 600 // optional — omitted means use platform default
}
}
```

Default behavior preserved: any adapter that doesn't override `BaseAdapter.idle_timeout_override()` (returns None) sends no `idle_timeout_seconds` field; the Go side falls through to `idleTimeoutDuration` (env `A2A_IDLE_TIMEOUT_SECONDS`, default 5min). Existing langgraph / crewai / deepagents are unaffected.

Components

Python:

• `adapter_base.py` — `idle_timeout_override()` method on BaseAdapter returning None
• `heartbeat.py` — `_runtime_metadata_payload()` lazy-imports the adapter, assembles the block, swallows ANY error so heartbeat never breaks because of capability discovery (observability outranks capability accuracy)

Go:

• `models.HeartbeatPayload.RuntimeMetadata` — pointer so absent = "old runtime, didn't say" vs explicit zero-cap = "new runtime, declared no native ownership"
• `handlers.runtimeOverrides` — in-memory sync.Map cache keyed by workspaceID. Populated by heartbeat handler, consulted on every dispatchA2A. Reset on platform restart (worst-case 30s of platform-default behavior — acceptable; nothing about overrides is correctness-critical)
• `a2a_proxy.dispatchA2A` — looks up the override before `applyIdleTimeout`; falls through to global default when absent

Tests (23 new)

Python (17):

• RuntimeCapabilities dataclass shape (frozen, defaults, wire keys)
• BaseAdapter.capabilities() default + override + sibling isolation
• idle_timeout_override default, positive override, dropped-override
• Heartbeat metadata producer: default adapter emits all-False, native adapter emits flag + override, missing ADAPTER_MODULE returns {} (graceful), zero/negative override is omitted from wire, exception inside adapter swallowed

Go (6):

• SetIdleTimeout + IdleTimeout round-trip; zero/negative clears; empty workspace_id ignored; replacement (heartbeat overwrites); Reset clears all; concurrent reads + writes (sync.Map invariant)

Verification

• 1308 / 1308 workspace pytest pass (was 1300, +8 — exact match for the 5 metadata tests + 3 idle-override tests added to the existing capabilities file)
• All Go handlers tests pass (6 new + existing)
• `go build ./...` + `go vet ./...` clean
• Manual: claude-code adapter declares 600s, hermes inherits default, both work end-to-end (validates after PR chore(template): add 4 evolution crons — ecosystem / plugins / template / channels #87 lands the per-adapter declarations)

Stacked

This is independent of PR #2137 (already merged). Each primitive is its own PR going forward.

🤖 Generated with Claude Code

[HongmingWang-Rabbit]

5-axis review

Correctness: ✓ Several careful design choices:

• IdleTimeoutSeconds *int (pointer) preserves the "absent vs explicit 0" distinction across the wire
• SetIdleTimeout(d <= 0) clears the override (consistent semantic everywhere — adapter can roll back to platform default cleanly)
• deleteIfEmpty GCs entries that lose all overrides AND capabilities (no empty husks accumulating)
• Defensive map copy in SetCapabilities prevents caller mutation of cached state
• HasCapability early-returns false on empty workspaceID OR name (safe defaults)
• a2a_proxy integration is a single-line addition: read override → fall through to idleTimeoutDuration global default

Tests: ✓ 23 new tests with real coverage:

• Python (17): RuntimeCapabilities defaults + override + sibling isolation; idle_timeout_override default/positive/zero/negative; heartbeat metadata producer including the "swallow ANY error so heartbeat never breaks" path (the right precedence — observability outranks capability accuracy)
• Go (6): SetIdleTimeout/IdleTimeout round-trip, zero-clears, empty-workspace-id ignored, replacement, Reset, concurrent reads + writes (sync.Map invariant pinned)

Architecture: ✓ Cache choice is well-justified inline:

• in-memory > DB roundtrip on the dispatch hot path
• 30s heartbeat = override changes propagate within one tick
• Platform restart → 30s of platform-default behavior (acceptable, none of these are correctness-critical)
• Stale-entry handling explicit (offline workspace = correct behavior when it comes back)

The runtimeOverrides package-level global is pragmatic; couples to package state but Reset() covers the testability gap, and threading a handler pointer through a2a_proxy would be a wider change for marginal value.

Security: ✓ No new auth boundary. Workspace already has a trusted bearer for /heartbeat — runtime_metadata reads inherit that trust. The forge-huge-timeout vector exists but doesn't make things worse: a workspace could already hang dispatches by just-not-replying. The override only extends a timer that exists anyway.

Performance: ✓ sync.Map atomic load per dispatch (zero contention under steady load); one heartbeat-rate write per 30s; defensive map copy is one allocation per heartbeat. Fine on every axis.

FYI (non-blocking)

• The wire keys (heartbeat, scheduler, session, status_mgmt, retry, activity_decoration, channel_dispatch) are duplicated between adapter_base.py:RuntimeCapabilities.to_dict() and runtime_overrides.go:HasCapability consumers. The inline "keep in sync there" comment flags it; codifying via a contract test (Python emits keys → Go reads same keys) at some point would close the drift surface, but YAGNI for primitive refactor(mcp-server): split 1697-line index.ts into per-domain modules #2 of 6.

LGTM. Updating branch + arming auto-merge.