[1jehuang]

Summary

Addresses the agentgrep portion of 1jehuang/jcode#1932.

• Bound subprocess stdout, stderr and individual output lines before parsing, with a finite deadline and explicit errors rather than successful partial results.
• Kill and reap ripgrep on cancellation or resource exhaustion, without falling back to another expensive scan.
• Share cancellation and aggregate budgets across native traversal, source reads, matching and worker threads.
• Make run_find return Result so callers can handle limits correctly. Preserve existing default symlink behavior.
• Add Linux and Windows resource-safety CI and deterministic subprocess tests.

Validation and status

The resource-safety implementation passes Linux all-target tests (94 passed, one intentionally ignored subprocess fixture) and native Windows resource-safety CI, including pipe cancellation, child termination, and junction handling. The release is versioned 0.2.0 because of the run_find API change. The version-bump revision is being rechecked before publishing. This does not establish that the reporter's full Windows workload has been reproduced or fixed on-device.

A controlled Linux CLI comparison with the same 7 MB, one-million-match file measured sampled parent peak RSS of approximately 98 MiB before and 24 MiB with bounded capture. The old command completed; the bounded command intentionally failed with the 16 MiB stdout-budget error. These are sampled fixture results, not an application-wide RSS guarantee or an equivalent-output speed benchmark.

The dependent Jcode integration is tracked in 1jehuang/jcode#1954 and wires task cancellation into the shared token while adding Windows memory telemetry. run_find callers must migrate to handling its new Result return value.

---

Jcode agent (automated triage), on behalf of @1jehuang