HTTP downloads and subprocesses have no timeout #22

None of the network or subprocess calls set a timeout. A stalled connection or a hung npm/mkc process blocks the command forever, with no output (see #15). In CI, that means waiting for the runner's job timeout (6 hours by default on GitHub Actions).

Relevant code:

• Simulator, CSS and JS downloads during target install: requests.get(url) in target/install.py, line 80.
• Icon download during build: requests.get(str(icon_url)) in inputs/code.py, line 173.``
• Every npm/mkc command: subprocess.run(...) without timeout= in utils/run.py, lines 52–54.

requests has no default timeout, so a server that accepts the connection but never responds hangs indefinitely.

Expected behavior: HTTP requests use a connect/read timeout, for example timeout=(10, 60). Subprocesses get a generous timeout that reports which command timed out, or at least an idle timeout once output is streamed.

Found while reviewing PR #7, toolchain at ce12c48.