Ambient mode wedges permanently (Running/0 cycles) when a model call hangs — no cycle timeout, no recovery from stuck Running

Start in crates/jcode-app-core/src/ambient/runner.rs at run_loop, run_cycle, and run_once_capture, then inspect manager.rs for should_run and the Running status handling. Reproduce the stuck state with the documented jcode serve command and compare the behavior with docs/AMBIENT_MODE.md. Done means a hung cycle becomes Incomplete or timed out, status recovers, and ambient mode can proceed again.

Title: Ambient mode wedges permanently (Running { running agent }, 0 cycles) when the provider model call hangs — no cycle timeout and no recovery from a stuck Running status

Environment: macOS; jcode serve started with --provider openrouter --model openrouter/free; ambient enabled in config with defaults.

Summary
When ambient mode is enabled and the serve process uses a model that cannot resolve to a concrete endpoint (or any model call that stalls open-ended), the first ambient cycle hangs forever inside run_cycle → run_once_capture. The persisted state stays {"status":{"Running":{"detail":"running agent"}},...,"total_cycles":0} indefinitely. Because should_run() returns false while status is Running, the loop can never advance; the only recovery is a manual state reset, and the CLI (ambient stop/trigger) fails on a debug-socket mismatch in this setup.

Evidence (from crates/jcode-app-core/src/ambient/runner.rs and manager.rs)

1. No timeout/deadline around an ambient cycle. The only tokio::time waits in run_loop are idle/interval sleeps (lines ~610, 701, 711, 716, 834); none wrap run_cycle or the agent run_once_capture (line ~965). A model call that never returns aborts nothing.
2. No auto-recovery from a stuck Running. Status resets to Idle only on start, on a cycle Err (line ~802), or after a successful cycle's record_cycle. There is no watchdog that resets a wedged Running back to Idle after a hang. Combined with manager.rs should_run() returning false for AmbientStatus::Running, a hung cycle wedges ambient permanently.
3. Consequence: 0 completed cycles, empty transcripts/, ambient.lock may go stale, and no notification/end_ambient_cycle continuity handling fires.

Expected behavior

• Ambient cycles should have a deadline (bounded model call; on timeout, record the cycle as Incomplete/timeout, reset status to Idle, and continue — per the AMBIENT_MODE.md crash-safety design).
• There should be a watchdog that resets a stale Running status (e.g. if a cycle exceeds a max age) so should_run() can return true again, consistent with "Incomplete" recovery described in docs/AMBIENT_MODE.md.

Reproduction

• Run jcode serve --provider openrouter --model openrouter/free with [ambient] enabled = true (pause_on_active_session=false).
• Watch ~/.jcode/ambient/state.json; it becomes Running / "running agent" and stays there with total_cycles: 0 indefinitely.

Suggested fix direction

• Add a per-cycle deadline (e.g. tokio::time::timeout around run_cycle) that produces an Incomplete/Interrupted result on expiry.
• Add a stale-Running watchdog that resets status to Idle (or Scheduled) if a cycle has been Running beyond a threshold, so the loop can proceed on the next wake.