Fix Lab cook timeout and provider rotation propagation

[chubes4]

Summary

Honor the declared timeout, provider rotation, and workspace mapping contract for Lab-offloaded agent-task cooks.

What changed

• Propagate the plan timeout into every provider request, including rotated attempts.
• Treat the first controller-resolved Lab rotation entry as the initial provider instead of adding an implicit default attempt.
• Resolve and remap both documented workspace input forms during Lab materialization.

How to test

1. Run cargo test --locked plan_timeout_reaches_each_rotated_provider_attempt --lib; expect passes.
2. Run cargo test --locked resolved_rotation_can_define_the_initial_provider_attempt --lib; expect passes.
3. Run cargo test --locked lab_source_path_uses_agent_task_dispatch_workspace --lib; expect passes.
4. Run cargo test --locked rewrite_remaps_agent_task_workspace_path --lib; expect passes.
5. Run cargo test --locked timeout_mirrors_remote_job_without_cancelling --lib; expect passes.
6. Run cargo check --locked --all-targets; expect passes.

Compatibility

Legacy non-Lab rotations remain fallback-based. Lab controller-resolved policies now execute the exact declared entries, and both --cwd and --workspace retain their documented behavior.

Evidence

• CI expected: CI
• Reviewer-resolvable source evidence: Fix Lab cook timeout and provider rotation propagation #8140
• all-target-check: Passed
• differential-audit: Passed
• focused-tests: Passed

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode direct recovery
• Model: openai/gpt-5.6-sol
• Used for: Diagnosed the Lab control-plane contract failure, implemented deterministic fixes and tests, and prepared the recovery candidate; Chris reviewed and owns the change.

Source relationships

• Closes Fix Lab cook timeout and provider rotation propagation #8140