bug(sdk): AgentShellOptions env/timeoutSeconds silently ignored (shell.ts)

## What happened?

`packages/sdk/src/shell.ts:34-75` accepts `AgentShellOptions` (`cwd`, `env`, `timeoutSeconds`, signal) but ignores `env`/`timeout`:

```ts
async exec(command: string, options?: AgentShellOptions): Promise {
const cwd = options?.cwd || this.config.getWorkingDir();
const abortController = new AbortController();
...
const handle = await ShellExecutionService.execute(
command, cwd, () => {}, abortController.signal, false,
this.config.getShellExecutionConfig(),
);
```

Callers cannot inject per-call env or bound execution time; the `AbortController` is orphaned (never linked to caller signal).

## What did you expect to happen?

Plumb `options.env` into spawn env, implement `timeoutSeconds` via `setTimeout → abort()`, accept an external `signal`, and return a timeout `error` instead of hanging.

## Client information

- Repo `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area `packages/sdk/src/shell.ts:34-75`, `packages/sdk/src/types.ts` (`AgentShellOptions`)
- Platform: SDK headless execution

## Login information

N/A — repro: `exec("env", { env: { FOO: "bar" } })` missing `FOO`; `exec("sleep 30", { timeoutSeconds: 1 })` hangs.

## Anything else we need to know?

Fix direction: merge env, timeout-abort, external signal passthrough; tests for env propagation + timeout error.

Start with packages/sdk/src/shell.ts:34-75 and the AgentShellOptions definition in packages/sdk/src/types.ts, then inspect ShellExecutionService.execute to trace environment and abort handling. Add tests covering per-call env propagation, timeout aborts with an error, and external signal passthrough; done means these cases no longer hang or silently ignore options.

Written by the indexing model from the issue text.