app-server: bound outbound requests by their total deadline

[bolinfest]

Why

currentTime/read has a fixed total request budget, but the wait to enqueue its outbound request on the shared channel was outside that budget. Under backpressure, the app server could dispatch the request after the caller's deadline, leading to late work and misleading timeout behavior. Increasing the timeout would only mask the queue contention.

This change makes the deadline behavior deterministic while we continue investigating the broader queue and instrumentation design. The structured timing work in #30334 remains the foundation for that follow-up.

What changed

• Added a deadline-aware single-connection outbound request path that bounds both queue admission and response wait.
• currentTime/read now uses that path, so its 10-second budget covers the outbound queue.
• Applied the same safety property to attestation generation requests, which use the same client-request pattern.
• Ensured a request that times out before queue admission does not leave a pending callback behind.
• Added a regression test for a full outbound queue.

Testing

• just test -p codex-app-server deadline_expires_while_waiting_for_outgoing_queue_capacity
• just fix -p codex-app-server

The broader app-server suite was also attempted, but unrelated sandbox-dependent tests cannot run in this environment because macOS Seatbelt operations fail with sandbox_apply: Operation not permitted.