Fix Docker sandbox timeout handling

[Yunnglin]

What changed

• Add in-container timeout wrapping for Docker sandbox commands so timed-out processes and child processes are terminated.
• Propagate timeout status through shell, Python, and multi-code executor tools.
• Add regression coverage for shell and Python executor timeout cleanup.

Why

Docker exec timeouts could leave child processes running after the caller reported a timeout. This made timeout handling incomplete and could leave work continuing inside the sandbox.

Validation

• git diff --check
• DOCKER_HOST=unix:///Users/yunlin/.colima/default/docker.sock conda run -n eval pytest tests/test_tool.py -k 'timeout' -q
• DOCKER_HOST=unix:///Users/yunlin/.colima/default/docker.sock conda run -n eval pytest tests/test_tool.py -q

[gemini-code-assist]

Code Review

This pull request introduces a mechanism to handle command timeouts inside the Docker sandbox using GNU timeout, along with robust process-tree termination when a timeout occurs. It also updates the Python, Shell, and Multi-Code executors to correctly propagate and report timeout statuses, and adds corresponding integration tests. The review feedback identifies two critical issues: first, the recursive kill_tree shell function fails to pass the signal argument down to recursive calls, preventing descendant processes from being terminated; second, if the timeout is zero or negative, _outer_timeout returns a non-positive value, which will cause asyncio.wait_for to immediately raise a TimeoutError and block execution.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.