fix(campaign): signal a timed-out run so it reaps its sidecar

CommandContext kills outright, so a run stopped by --run-timeout never ran its
own shutdown and left a sidecar holding a port and a quarter gigabyte,
reparented to init and deaf to SIGTERM. The timeout exists for unattended
hosts, which is exactly where nobody is watching to reap what it leaves.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

cmd/internal-tools/campaign/end_to_end_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"io"
 	"os"
@@ -9,6 +10,7 @@ import (
 	"slices"
 	"strings"
 	"testing"
+	"time"
 )
 
 // stubSanderling answers `version`, writes a run directory shaped like the one
@@ -142,3 +144,28 @@ func TestRun_EndToEndAgainstStubBinary(t *testing.T) {
 		t.Errorf("progress output: %q", stdout.String())
 	}
 }
+
+func TestExecuteCommand_RunTimeoutSignalsSoTheRunReapsItsChildren(t *testing.T) {
+	directory := t.TempDir()
+	marker := filepath.Join(directory, "child-reaped")
+	script := filepath.Join(directory, "wedged")
+	body := "#!/bin/sh\n" +
+		"sleep 300 &\n" +
+		"child=$!\n" +
+		"trap 'kill $child; echo reaped > " + marker + "; exit 143' TERM\n" +
+		"wait $child\n"
+	if err := os.WriteFile(script, []byte(body), 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if _, err := executeCommand(ctx, script, nil, io.Discard); err != nil {
+		t.Fatalf("execute: %v", err)
+	}
+
+	if _, err := os.Stat(marker); err != nil {
+		t.Fatal("the run timeout killed the run outright, so it never reaped its own children: " +
+			"an unattended sweep leaks one sidecar per wedged run")
+	}
+}