fix(cso): count remainingSeconds to the investigation deadline; bound and validate the tool timeline

remainingSeconds now measures to deadline - 60s, the point where scan,
verify and record-review refuse with DEADLINE, and inspect carries it.
The post-command clock lookup can only omit the field, never fail a
command whose state change is already saved. The stream timeline records
end times from tool_result, indexes only recorded calls so it stays at
the 4096 cap, and receipts reject malformed timeline entries.

scripts/cso-eval-protocol.ts

@@ -131,7 +131,7 @@ export interface ProducerReceipt {
   firstUsefulResultMs: null;
   toolCalls: number;
   /** Content-free tool timeline (name, offset, thread) for diagnosing overruns; absent when the adapter has none. */
-  toolTimeline?: Array<{ atMs: number; tool: string; agent: 'main' | 'subagent' }>;
+  toolTimeline?: Array<{ atMs: number; endMs?: number; tool: string; agent: 'main' | 'subagent' }>;
   output: string;
   outputHash: string;
   usage: {