Harden production workflows and agent admission

agent/internal/runner/runner.go

@@ -62,8 +62,9 @@ func Run(ctx context.Context, argv []string, timeout time.Duration) Result {
 	}
 
 	if cctx.Err() == context.DeadlineExceeded {
-		r.Status = StatusUnknown
-		r.ExitCode = -1
+		r.Status = StatusCritical
+		r.ExitCode = 2
+		r.Output = fmt.Sprintf("critical: check timed out after %s", timeout)
 		return r
 	}
 	if err != nil {

agent/internal/runner/runner_test.go

@@ -97,9 +97,12 @@ func TestRunUnknownExit(t *testing.T) {
 
 func TestRunTimeout(t *testing.T) {
 	r := Run(context.Background(), []string{"sh", "-c", "sleep 5"}, 200*time.Millisecond)
-	if r.Status != StatusUnknown {
+	if r.Status != StatusCritical || r.ExitCode != 2 {
 		t.Fatalf("got %+v", r)
 	}
+	if !strings.Contains(r.Output, "critical: check timed out after 200ms") {
+		t.Fatalf("output: %q", r.Output)
+	}
 	if r.DurationMs > 2000 {
 		t.Fatalf("duration too long: %d", r.DurationMs)
 	}