refactor(cli): bound every agent call with one budget

`crate::agent` gave a snapshot five seconds (`SNAPSHOT_TIMEOUT`) and the fixture recorder gave each of its four semantic reads the same five seconds under its own name (`READ_TIMEOUT`) — one decision, how long a connected agent may take to answer, written twice.

`agent::call` bounds any RPC by the one `CALL_TIMEOUT` and says which way it failed (`CallFailure::{TimedOut, Disconnected}`); `snapshot` and the recorder's reads go through it and keep their own wording. The access guard now also flags an RPC issued outside `agent::call` (four findings on the parent commit, none here); test modules, which serve their own in-process agent, are exempt.