fix(agent): measure batch-deadline exclusion at the human wait, not authorization-gate residency

[kshitijk4poor]

Summary

A tool wedged inside the concurrent authorization gate no longer hangs the turn forever: the batch deadline now excludes only verifiable human approval waits (measured at the source, in tools/approval.py), not residency in the gate — so a hanging pre_tool_call plugin or a dead approval client times the batch out normally instead of defeating the deadline entirely.

Root cause (#79719): excluded_seconds() measured wall-clock residency in gate.run() — arbitrary code — and the deadline loop adds it to the deadline on every poll. With a window open, remaining = (deadline + (now − window_started)) − now = deadline − window_started: constant, so the deadline never fired. The serialization lock was also an unbounded acquire, parking every other worker behind the wedged holder.

Changes

• tools/approval.py: per-session human-wait accounting (human_wait_window / human_wait_seconds). The two places genuinely parked on a human — the CLI approval prompt (prompt_dangerous_approval) and the gateway approval poll loop (_await_gateway_decision) — mark their own windows. Overlapping windows coalesce; per-window contribution is clamped (read-side AND close-side) to approvals.timeout + 60s, since every legitimate wait self-terminates at approvals.timeout; table capped at 256 sessions with idle-only eviction.
• agent/tool_executor.py: _ConcurrentToolAuthorizationGate keeps only serialization, with a bounded acquire (approvals.timeout + 60s; on expiry the prompt runs unserialized — the same degradation the start-order gate accepted in fix(agent): bound the concurrent start-order gate under the batch deadline (salvages #79571) #79705). excluded_seconds() is a baseline-delta read of the session's human-wait total.
• tests/run_agent/test_authorization_gate.py: 17 tests — tracker semantics, session isolation, both clamps, eviction cap, lock-timeout degradation, the issue's exact degenerate-arithmetic repro (remaining must converge), and instrumentation checks for both approval paths. The gate previously had zero test coverage.

Validation

Scenario	Before (upstream/main)	After
Wedged pre_tool_block plugin, 3s batch deadline (real AIAgent E2E)	turn never ends (>30s observed; algebraically never)	ends at 3.0s, tools labeled timed-out
4s human approval over a 2s deadline (E2E)	excluded (correct)	still excluded — completes, no timeout label
Other worker needs authorization behind wedged holder	parked forever	proceeds unserialized after the bound

Targeted suites: 17/17 new + 3/3 start-order gate + 19/19 Concurrent* in test_run_agent.py + approval suites green (1 pre-existing failure on clean main, unrelated). tests/tools/ full sweep diffed against an upstream/main baseline worktree: no new failures. No new config keys (reuses approvals.timeout), no env vars, no message/prompt mutation.

Credit

@x7peeps (#79755) and @RelaxJonh (#80134) both proposed bounding the gate for this issue — #79755's bounded acquire + approval-timeout-derived ceiling overlaps the serialization half here. This PR goes one step further and removes gate residency from the deadline arithmetic entirely, so the exclusion only ever tracks a pending human prompt.

Closes #79719