Harden production workflows and agent admission

agent/internal/runner/runner.go

@@ -62,8 +62,9 @@ func Run(ctx context.Context, argv []string, timeout time.Duration) Result {
 	}
 
 	if cctx.Err() == context.DeadlineExceeded {
-		r.Status = StatusUnknown
-		r.ExitCode = -1
+		r.Status = StatusCritical
+		r.ExitCode = 2
+		r.Output = fmt.Sprintf("critical: check timed out after %s", timeout)
 		return r
 	}
 	if err != nil {