fix(cli): bound run setup RPCs and report startup progress

[shuv1337]

shuvcode run could wait silently on uncapped setup RPCs before producing output. Startup and stdin progress now go to stderr. Location and session setup RPCs have individual 30-second deadlines; prompt admission has a separate 120-second deadline to accommodate plugin activation. Execution and its event stream remain uncapped.

An admission timeout reports the known session and request IDs as ambiguous delivery and exits without retrying admission or creating a replacement session. Piped input still waits for EOF and retains late input.

Validation covered isolated candidate CLIs with explicit loopback fake-server endpoints and isolated HOME plus all four XDG directories: setup and response-body stalls, ambiguous admission without duplicates, cleanup blocked on another RPC, nonempty healthy output, and delayed piped input. The pipeline also passed unscaled 30-second setup and 120-second admission probes, a 150-second execution stream, and stdin held open for 40 seconds. The fixture-driven CI cases use proportionally shorter deadlines. Root lint and type checks passed.

Fixes #412

[shuv1337]

🔍 Automated Cursor review is underway. Please hold off on merging until the review comment lands here (usually 10–20 minutes).

[shuv1337]

Review complete: no findings. Checked that setup deadlines stay off execution RPCs and the event stream, timers are cleared when a setup call finishes, an admission timeout does not retry or open another session, JSON stays on stdout, and the subprocess tests use an isolated temp server with scaled deadlines.