fix(runner): wait for remote process containment before reuse

Await the ownership-fenced remote termination monitor before session close resolves. Bound EC2 verification checks to retain failure evidence before fleet shutdown.

Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -167,6 +167,8 @@ jobs:
           echo "Image: $immutable" >> "$GITHUB_STEP_SUMMARY"
       - name: Verify repository on EC2
         if: inputs.verify_source
+        # Leave time for artifact retention before the fleet's one-hour lifetime.
+        timeout-minutes: 38
         run: |
           set -uo pipefail
           pnpm install --frozen-lockfile --ignore-scripts
@@ -174,8 +176,11 @@ jobs:
           for check in 'pnpm -r typecheck' 'pnpm test:run' 'pnpm check:token-gates' 'pnpm test:e2e:runner:typecheck' 'pnpm test:e2e:runner:unit' 'pnpm build'; do
             label="$(echo "$check" | tr -cs 'a-zA-Z0-9' '-')"
             echo "Starting $check"
-            bash -c "$check" > "remote-verification/$label.log" 2>&1 || status=1
-            echo "Finished $check"
+            check_status=0
+            timeout --signal=TERM --kill-after=15s 15m bash -c "$check" > "remote-verification/$label.log" 2>&1 || check_status=$?
+            printf '%s\t%s\n' "$check_status" "$check" >> remote-verification/check-status.tsv
+            if [ "$check_status" -ne 0 ]; then status=1; fi
+            echo "Finished $check (exit $check_status)"
           done
           exit "$status"
       - name: Build canonical eval report viewer