Read a Launcher That Builds an Inner timeout as Nesting #2195

Problem

gh-write-guard.py reads a nested timeout only where a word names timeout. A launcher can build the inner timeout from its own arguments, so no word names it, and the outer timeout is read as the bound. These are allowed, and an outer SIGKILL can end the inner timeout before its deadline while the loop under it keeps running:

timeout -s KILL 10 env -S 'timeout 800' bash -c 'until [ -f x ]; do sleep 60; done'
echo timeout | timeout -s KILL 10 xargs -I% % 800 bash -c 'until [ -f x ]; do sleep 60; done'

Origin

Raised by a local strict review on feature/auto-1634 (handoff #2072). Decision #2118 chose to declare this class in host-setup/agent-safety/README.md requirement 7 as a shape not reached, and to file it as this follow-up.

Done looks like

Either the guard reads a launcher that runs a command built from its arguments (env -S/--split-string, xargs with a replacement string, and any others named) as possible nesting, with a self-test row for each shape above, or this issue closes with the declared limit kept as the answer.