fix: bound Windows block-monk helper wait

[paulcakeface]

Fixes #382.

Bounds the PowerShell monk-agent hook block-monk helper wait so a wedged helper cannot consume the host hook timeout before the existing native parser can return a deny decision.

• replaces unbounded .WaitForExit() with a 2-second helper deadline
• kills a wedged helper and falls back to the native parser
• covers Claude-style and Antigravity PowerShell hook copies
• adds deterministic wedged-helper and successful-helper controls

Validation: block_monk_powershell_helper_timeout=pass; patched Antigravity and Claude-style cases return deny in ~3.08s / ~2.83s including container startup; PowerShell parser checks, distributed-copy equality and git diff --check pass.

Exact commit: 052c727c1274f1fabf0a457d6604528e46ff0f55.

Note: GitHub created this as a draft during the cross-fork API instability. The diff and validation are complete; the available credential currently cannot toggle the draft flag through GraphQL.

Assisted-by: GPT-5.6 Sol

[paulcakeface]

Closing this accidental draft; the same exact tested commit will be re-opened as a normal ready-for-review PR linked to #382.