fix(timeout): support Windows spawn semantics

[dexhunter]

Summary

• replace the nested Windows multiprocessing target with a dedicated subprocess worker
• serialize local callables, arguments, results, and exceptions with cloudpickle
• keep worker I/O on private temporary files so user stdout cannot corrupt the protocol or block the parent
• terminate the worker process tree when the timeout expires

Fixes #79

Why

Windows uses spawn semantics, so the previous nested run_func target could not be pickled. Valid parse and verify calls then failed or silently returned empty/false results. Running a package-owned worker module avoids importing the caller's __main__ module and also supports local callables.

I ran a 12-step autoresearch trajectory with Weco against a strict timeout contract evaluator: public run. The final patch keeps the subprocess/cloudpickle direction and adds bounded cleanup, isolated transport, and regression coverage.

Validation

• strict timeout contract evaluator: 5/12 -> 12/12
• Linux full suite: 295 passed, 1 skipped
• native Windows validation: all timeout tests and issue repros passed
• Ruff on changed files: pass

The Windows coverage checks local callables in a distinct PID, real parse/verify calls, exception transport, timeout cleanup, and descendant-process termination.