Prompt steps take a caller-supplied time limit (X-8a)

Prompt steps called call_provider without a timeout, so every AI call was cut at its
300 s default whatever the caller allowed. Now:
- PromptStep has an optional `timeout` (seconds) in its YAML;
- a universal --provider-timeout (tool wrappers, `cmdforge run`, `run-once`) sets the
  caller's limit, carried in ProviderExecutionPolicy so nested tools get it too;
- precedence: --provider-timeout, then the step's timeout, then 300 (unchanged default).

Requested by Orchestrated Discussions, whose work phases need attempts longer than 300 s.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/cmdforge/runner.py

@@ -559,6 +559,8 @@ def execute_prompt_step(
 
     # Determine provider
     provider = provider_override or substitute_variables(step.provider, variables, warn_non_scalar=verbose)
+    # How long the provider may take: the caller's --provider-timeout, else the step's timeout, else 300 s
+    step_timeout = effective_policy.provider_timeout or step.timeout or 300
 
     # Build context from the inside out so the final order is:
     # profile system prompt -> skills -> user prompt.
@@ -580,7 +582,7 @@ def execute_prompt_step(
             result = mock_provider(prompt)
         else:
             result = call_provider(
-                provider, prompt, max_tokens=step.max_tokens,
+                provider, prompt, timeout=step_timeout, max_tokens=step.max_tokens,
                 execution_policy=effective_policy,
             )
 
@@ -629,7 +631,7 @@ Please try again with valid JSON matching the schema exactly."""
             result = mock_provider(current_prompt)
         else:
             result = call_provider(
-                provider, current_prompt, max_tokens=step.max_tokens,
+                provider, current_prompt, timeout=step_timeout, max_tokens=step.max_tokens,
                 execution_policy=effective_policy,
             )
 
@@ -1186,6 +1188,8 @@ def create_argument_parser(tool: Tool) -> argparse.ArgumentParser:
     parser.add_argument("--require-model-identity", action="store_true")
     parser.add_argument("--require-model-digest", action="store_true")
     parser.add_argument("--result-envelope", choices=["json"])
+    parser.add_argument("--provider-timeout", type=int,
+                        help="Seconds each AI provider call may take (overrides the tool's own step timeouts)")
 
     # Tool-specific flags from arguments
     for arg in tool.arguments:
@@ -1315,6 +1319,7 @@ def main():
         data_classification=args.data_classification or "public",
         require_model_identity=args.require_model_identity,
         require_model_digest=args.require_model_digest,
+        provider_timeout=args.provider_timeout,
     )
     provider_calls = []