fix(aibox): close audit findings H1-H3/M1-M2 (command exec protection chain)

- H1: CommandLineTool.execute_streaming now purely delegates to injected
  executor; removes 150-line duplicate Popen loop that bypassed 1MB cap,
  cancel() and timeout protections
- H2: thread the blocking readline into a daemon reader thread; main loop
  polls queue with 0.1s ticks so timeout/1MB checks fire even for silent
  commands (verified: 3s timeout on 15s sleep, was 15s+ before)
- H3: stdin=DEVNULL on both Popen sites; stdin-waiting commands now hit
  EOF instead of deadlocking the tool thread forever
- M1: heredoc delimiter uniquification in write_file guidance (content
  line equal to AIBOX_EOF no longer truncates into shell injection)
- M2: 3600s total deadline on registry streaming forward loop

Verification: PoC regression 5/5 PASS (timeout/1MB/cancel/delegation),
full unit suite 264 passed. Audit report updated with Batch E results.

aibox/tools/registry.py

@@ -84,10 +84,19 @@ class ToolRegistry:
                 )
                 thread.daemon = True
                 thread.start()
-                
-                # 从队列收集输出并发送到当前队列
+
+                # M2 修复（审计 2026-08-17）：转发循环加总超时。
+                # 此前 while thread.is_alive() 在工具内部卡死（如子进程
+                # 等待 stdin）时永不退出；超时后放弃等待，避免本调用
+                # 线程被连带挂起。
+                tool_timeout = 3600  # 单工具总上限 1 小时（工具自身的秒级超时之外的兜底）
+                deadline = time.time() + tool_timeout
                 final_result = None
                 while thread.is_alive() or not output_queue.empty():
+                    if time.time() > deadline:
+                        self.logger.warning(
+                            f"工具 {name} 流式执行超过 {tool_timeout}s 总上限，放弃等待")
+                        return f"❌ 工具执行超时（>{tool_timeout}s，已放弃等待）"
                     try:
                         msg_type, content = output_queue.get(timeout=0.1)
                         if msg_type == "line":