DevinSession: a hung setup handshake (session/new / session/load) has no timeout

## What is wrong

`DevinSession`'s stall watchdog (added in #116) only covers a running turn - it is armed in
`beginTurn` and `handle()` only refreshes `lastMessageAt` `if (this.running)`
(`src/daemon/devin-session.ts`). A `session/new` or `session/load` that the ACP process accepts
and never answers is still an unbounded wait: no turn is running yet, so the watchdog never arms,
and `open()` has no timeout of its own around the `initialize` → `authenticate` →
`session/new`/`session/load` handshake.

Flagged during #116 review (comment on that issue, 2026-09-15): "worth its own issue if you agree
it is real." It is real - the handshake is exactly as capable of hanging as a turn is, just not
covered by the fix that shipped for turns.

## Acceptance criteria

- [ ] A session that never completes its `initialize`/`authenticate`/`session/new`/`session/load`
handshake is reported as stalled within a bounded period, the same way a silent turn is
after #116, rather than left open indefinitely.
- [ ] A test covers a fake ACP server that accepts `session/new` (or `session/load`) and never
answers it.

## Out of scope

- Anything already covered by #116 (turn-level silence, inbound request handling, the
now-removed `devin doctor` check).

## Verification

```
pnpm test
pnpm exec tsc -p tsconfig.json --noEmit
```

## Related

- #116 - the watchdog this extends coverage to.

Start in src/daemon/devin-session.ts, reading open(), beginTurn(), and handle() to compare the existing turn watchdog with the initialize → authenticate → session/new/session/load handshake. Add a test using a fake ACP server that accepts session/new or session/load without answering, then run pnpm test and pnpm exec tsc -p tsconfig.json --noEmit; done means the handshake is reported stalled within a bounded period.

Written by the indexing model from the issue text.