state_exec/ariadne: render-pass park safety — per-step cap + read-lane guard (§13.8)

[transfix]

Keeps a render-pass state_exec program that awaits/parks from breaking the render thread — the last piece of the §13.8 async/await arc (transparent http-get #474, generic fetch #475 both merged).

This is a pivot. The adversarial review of the first attempt (a per-activation time budget that would kill a runaway resident) found it genuinely unsafe, so this ships the safe subset and defers the hard part:

• HIGH — a buffered input-event burst drains through the msg-recv fast-path sharing one activation budget → a legitimate input resident is killed, and ensure_input_residents never resubmits it → input silently dies.
• HIGH — a sleep(0)/self-wake spin resets its budget every wake → escapes the kill.

Distinguishing a genuine external wait from a self-spin needs more than a wake count, so killing a persistent spinner is left as future work behind a safe backstop.

What ships (two layers)

1. Read-lane guard. The reactive lane (visible_when/computed) is structurally park-proof — a private idle scheduler that's never pumped, and an allowlist that excludes await/msg-recv/http-get/fetch. So a park verb in a predicate is denied (unbound → fail-safe hidden, render returns), not parked into a lane that would silent-nil. Asserted over both msg-recv and await.
2. Per-STEP cap. Residents/actions run in drain() off the draw walk, bounded by the pump's per-drain cap (a per-node DSL loop degrades but never hangs). The gap the pump can't cover is a single evaluator step that loops in place (a runaway native builtin never returns → the pump's between-step check never fires). Fix: process::max_step_time — a per-step deadline armed fresh each step via the same eval_deadline_guard an action's max_time uses, so it aborts an in-step loop + kills the process, yet never accumulates and so never kills a long-lived resident. ensure_resident wires it at 50 ms.

Also fixes a latent double-count: a parking intrinsic already books its running slice into accumulated_time + sets waiting, but execute_process_step re-added the same slice unconditionally — now guarded on status == running (mirroring elapsed_time()).

Deferred (documented)

Killing a persistently spinning resident (vs the pump bounding it each drain) — needs real-wait-vs-self-spin accounting the review showed the naive per-activation budget botches.

Tests

PerStepCapLeavesHealthyWorkUntouched (no false-kill + plumbs through), ParkVerbInPredicateIsDeniedNotHung (msg-recv and await denied), RunawayTickResidentIsBoundedAndSchedulerRecovers (a runaway on:tick is pump-bounded, drain() returns, a replacement resident fires). Full regression across async/scheduler/intrinsics/integration green; 0/25 flaky on the timing cases.