Host should timeout if calling into a Startup never returns

I've run into a scenario where calling into a customer's Startup caused a (rare) deadlock. The end result was that the infrastructure thought everything was healthy (process running, responding to ScaleController pings, external requests returning errors), yet the host never started so it sat there forever in that state, causing an outage. A restart fixed it, even though this happened again at another point.

While we can't fix a deadlock in customer code, we could detect that things aren't healthy if Startup didn't return after (for example) 2 minutes and kill the process.

My paranoia makes me wonder if some Startups actually do take a long time and are completely healthy... it may be worth first adding logs to help up see to see what our longest Startup call across the whole system is as a data point.

The issue names no files or tests. Start by tracing the host's call into customer Startup and how that relates to ScaleController health pings; first gather Startup duration data to distinguish rare deadlocks from healthy long-running startup. Done means the timeout behavior and its handling of legitimately slow Startups are specified and validated.

Written by the indexing model from the issue text.