fix(cli): restrict timeout cleanup to tracked child

[KooshaPari]

Summary

• remove Windows process-tree and WSL distribution-wide timeout cleanup from the Podman command runner
• reap only the exact Rust Child handle created for the bounded command
• preserve fail-closed timeout diagnostics and the existing API/error contract

This is intentionally stacked on PR #119. No container, WSL, provider, or interactive-session actions were performed.

Validation

• cargo check --manifest-path crates/phenocompose-cli/Cargo.toml --locked --target-dir C:\\Temp\\phenocompose-safe-timeout-target: pass
• cargo test --manifest-path crates/phenocompose-cli/Cargo.toml --locked --target-dir C:\\Temp\\phenocompose-safe-timeout-target --no-run: pass (test binaries compiled; tests not executed because timeout tests intentionally exercise child termination)
• git diff --check: pass
• bounded source audit: no taskkill, WSL terminate, process-tree, or distro-wide cleanup symbols remain; only tracked Child handle cleanup remains
• repository-wide cargo fmt --check: pre-existing unrelated rustfmt drift; no unrelated formatting changes applied

No merge, release, runtime start, process cancellation, or provider request performed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[KooshaPari]

Closing stale draft (audit cleanup 2026-08-19). Reopen if still relevant.