… aren't clamped to 250ms (#1867)

Nested cross-object writes from a hook (`ctx.api.object('parent').update(...)`
from a child's afterInsert/afterUpdate) once crashed the QuickJS sandbox with
`memory access out of bounds` — the old single-suspended-asyncify host-call
model could not unwind the WASM stack twice. That crash is already fixed on main
by the deferred-promise + pump host-call model (host calls no longer asyncify;
each invocation gets its own isolated VM), so any depth of nested re-entrancy
now composes safely.

The remaining reliability blocker was the timeout: `resolveTimeout` folded the
engine default (250ms for hooks) straight into `Math.min(...)`, so it always
dominated. A hook body that declared a larger `timeoutMs` (the spec allows up to
30_000ms via `ScriptBody.timeoutMs`) to give a legitimate nested-write rollup
room to settle was silently clamped back to 250ms and killed mid-flight — a
declared-but-unenforced knob (AGENTS.md Prime Directive #10) that pushed authors
toward denormalized hand-maintained rollups.

The engine default is now a FALLBACK used only when no explicit timeout is
supplied, not a hard ceiling. An explicit `body.timeoutMs` (and/or an enclosing
hook/action timeout via opts) is honored; when both are present the smaller
wins. Unspecified bodies still get the 250ms hook / 5000ms action default, and a
body may still lower its own timeout below the default.

Tests:
- quickjs-runner.test.ts — nested sandbox re-entrancy (single, 4-level chain,
  concurrent fan-out) does not crash; timeout resolution honors a body's
  declared timeoutMs above the default, still applies the default when
  unspecified, and still lets a body lower it.
- nested-write.integration.test.ts — real ObjectQL engine + sandbox: a child
  afterInsert/afterUpdate hook rolls its total up to the parent (parent also has
  a hook → real nested VM) without crashing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BZguyAaQbyUpwMZ2gMLaAP

#1867)

Add a "Nested cross-object writes" note to the hook-bodies guide: a body may
write other objects (child afterInsert/afterUpdate → parent update), the target's
own hooks fire in a fresh sandbox VM, it composes to any depth, and a deeper or
slower rollup chain should declare a larger timeoutMs (up to 30s) rather than
rely on the 250ms single-write default. Documents the capability the runtime now
delivers instead of the denormalized workaround.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BZguyAaQbyUpwMZ2gMLaAP