execute: unprivileged commands should not be subject to the approval/execution timeout

[cuihtlauac]

Summary

execute applies its timeout (default 120000 ms, clamped to 600000)
uniformly to privileged and unprivileged requests. For unprivileged commands
(privileged: false, which run as the invoking user with no escalation), the
timeout adds little safety but creates a false-failure mode: a command that
is ultimately approved and executes successfully can still be reported to the
caller as timed out.

Why unprivileged is different

The timeout's value is as a safety bound on privileged actions. An
unprivileged command runs as the user, who could run it directly in a shell with
no bound at all. Legitimate unprivileged workloads are frequently long-running
or slow-to-approve — dev servers, file watchers, builds — and shouldn't be
failed by a wall-clock deadline.

Observed

Launching a detached, long-running unprivileged server:

execute(
  privileged = false,
  argv = ["bash", "-lc",
    "cd /path/to/repo && setsid /path/to/deno run --allow-read --allow-net --allow-env \
     src/server/index.ts serve /path/to/repo >/tmp/server.log 2>&1 </dev/null & disown; \
     sleep 5; curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://localhost:7171/"]
)

The caller received:

server did not respond within 120s — it may be busy with another command or waiting for user approval

…but the command had in fact been approved and executed: the server was
running and serving HTTP. The deadline elapsed because it counts human-approval
latency — approval landed after the caller's window closed.

Impact

• False failure — the caller believes the command failed when it succeeded.
• Double-execution risk — a caller that retries a "timed-out" side-effecting
  command runs it twice.

Proposal

For privileged: false requests, do not impose an execution/approval timeout
(or make any timeout opt-in and unbounded by default). At minimum:

• don't count human-approval wait time against the execution deadline, and
• distinguish "not yet approved" from "executed but slow", so a caller cannot
  misread an approved-and-run command as a failure.

Environment

sudo-proxy 1.1.0 (local daemon).