Thread the execution context through the interpreter

[tobert]

The interpreter functions between the pipeline runner and the dispatch layer read per-invocation state from the shared Kernel::exec_ctx slot, which dispatch_command and dispatch_statement copy into and back out of (GH #369). Two bugs came from that shape, each pinned by a test that failed before its fix:

f() { bash script; }; timeout 1 f        # ran past the deadline
echo x | alias greet='echo hi'           # greet defined afterward
echo x | kaish-output-limit off          # limit still on afterward

This branch threads an ExecContext parameter through the interpreter in one mechanical commit, then moves one field family at a time from the slot to that context. A pipeline's last stage now returns every session change, the same as a statement run on its own. The cancel token and watchdog come from the context a command is called with, so timeout reaches an external command in a function body, in a piped function body, and inside $(...) in that body's arguments. The argument binder carries the caller's context through a KernelArgSource. Embedder tools still run on the kernel's context slot, so the arm that calls them copies the command's cancel token and watchdog onto it first; embedder_tool_sees_the_call_timeout pins that a request timeout stops such a tool.

Still to come on this branch: $(...) in a redirect target, heredoc, or here-string gets the caller's cancel token (it still builds a root context in CommandDispatcher::eval_expr); stdin and pipe ends move to the context, which also fixes echo "got [$(cat f)]" | cat printing only the file; then pipeline position and background flags, session fields, and deleting the dispatch layer's copy-in and copy-back. Draft until those land.

Stacked on #451.

🤖 Generated with Claude Code

[tobert]

kaibo review, cast deepseek (explorer and synth deepseek-flash). It read the whole files on commit a8939b7, without a diff. Findings, and what happened to each:

Defect 2 (regression from 8873dfc): the embedder-tool arm of execute_command_depth hands backend.call_tool the shared slot, and C4 removed the only thing that refreshed the slot's cancel (dispatch_command's copy). At top level the slot holds a constructor-default token that nothing ever cancels, so an embedder tool that waits on cancellation ignores Kernel::cancel(), a request timeout, and timeout. The test-only BackendDispatcher passes the threaded ctx, which is why no test saw it. Fixed in the follow-up commit with a test that fails first.

Defect 1 (existing, not a regression): CommandDispatcher::eval_expr, which evaluates $(...) in redirect targets, heredoc bodies, and here-strings, builds a root context from the kernel's token. So timeout around a function body does not reach an external command inside > "$(slow)". Before this branch, execute_pipeline also read the kernel token on that path. Recorded as the next item on this branch, with its own test.

No defect found in:

• the watchdog chain for patient holds;
• KernelArgSource's stdin consumption and locking;
• the last-stage join leaking session changes;
• whether the four new tests can fail for the reason they name.

Existing, noted for later:

• ExecuteOptions::interrupt cannot stop a loop running on a pipeline-stage or scatter fork (fork_inner clears interrupt).
• A stage before scatter keeps a kaish-ignore change that an ordinary non-last stage drops.

🤖