#247 Built-in models must honor AbortSignal so --timeout works in practice

Context

swamp-club#235 added --timeout to model method run and workflow run. The CLI wires AbortController correctly via libswamp's existing LibSwampContext.withTimeout(ms) helper (src/libswamp/context.ts:47-50), and ctx.signal reaches the method execution context (src/libswamp/models/run.ts:448).

The bug

Built-in models do NOT honor the abort signal. Discovered during issue #235 implementation:

swamp model method run smoke execute --input run='sleep 10' --timeout 1s --json
# Method runs for 10 seconds. Timeout has no effect.

The command/shell model spawns a child process via Deno.Command but does not pass the signal. Specifically: src/domain/models/command/shell/posix_shell_strategy.ts and the powershell variant construct Deno.Command without a signal option.

Why this matters

Without signal propagation, --timeout is documented as cooperative-only and effectively useless for the most common use case (running shell commands). The flag ships in #235 with help text describing this limitation, but the limitation should be removed.

What needs to happen

1. Thread signal from the model execution context into every built-in model's child-process spawn (Deno.Command accepts { signal }).
2. For non-process-spawning models (e.g. anything that does HTTP, file I/O, polling), check signal.aborted at iteration boundaries and throw DOMException('aborted', 'AbortError') so libswamp's existing handler at run.ts:579 converts it to SwampError { code: 'cancelled' }.
3. Add a UAT scenario in swamp-uat verifying --timeout 1s against command/shell actually cancels.

Files

• src/domain/models/command/shell/posix_shell_strategy.ts
• src/domain/models/command/shell/powershell_strategy.ts
• Other built-in models under src/domain/models/ that spawn processes or do I/O