Schema mode: force a final StructuredOutput turn before the caller's deadline #138

Context

Production, 2026-10-08. A PR Explanation in --output-schema mode on gemini-3.8-flash (aictrl app execution 455c9508…) ran 48 steps at about 37 s per step and hit the executor's 30-minute wall-clock limit (exit 124). It never called StructuredOutput: there were no structured_output_rejected events, and the terminal structured_output was failed. A later run on the same PR completed in 13 minutes, and GLM runs take 5–8 minutes. So slow models can run out of time while still exploring, with no result at all.

Problem

Schema mode ensures that if the model submits, the result is valid. It does not ensure the model submits before the caller's deadline. The CLI's step cap is in steps, while the executor's limit is wall-clock time and invisible to the CLI.

Proposal

• Add an optional deadline, e.g. --deadline <iso-or-epoch-ms> or AICTRL_RUN_DEADLINE, and an optional wrap-up fraction (default 0.8).
• When schema mode is active and the wrap-up point is reached, end tool use on the next turn: send a corrective message ("time is nearly up; return the final result now from what you have") with tool choice forced to StructuredOutput by name. This is the same mechanism as the missing-result corrective turn added in fix(run): output-schema review follow-ups and provider constraint hints #134.
• The wrap-up turn counts against the corrective budget, and validation and repair still apply. If the deadline passes before a valid result, the run fails with structured_output: failed / deadline (a new reason) and exit 3, instead of being killed externally.
• Without --output-schema, or without a deadline, nothing changes.

Acceptance criteria

• Tests with the fake provider and a slow-tool fixture: a wrap-up turn is forced at the deadline fraction, the model returns a valid result, and the run exits 0 before the deadline.
• A deadline exceeded without a valid result gives a terminal failed / deadline event and exit 3.
• The NDJSON and EVENTS.md document the new reason.
• Follow-up in the app repo: the aictrl executor passes its MAX_DURATION deadline (minus a publication margin) to the CLI.

Related: #134 (named corrective tool choice), #135 (permission auto-reject stop), aictrl-dev/aictrl#5960.