ci(integration): bound every test, so a deadlock fails by name instead of by timeout

[BitHighlander]

Step 2 of #466 — harness robustness. Does not attempt the expectation updates, which belong with the deps/python-keepkey repin.

Before / after, same emulator, same tests, same firmware

before	30-minute job kill, no JUnit XML, Phase 2 never runs, every file after the stall unmeasured
after	22 failed, 362 passed, 47 skipped in 133.59s, 66KB of JUnit XML

What it does

Bounds each test rather than the job. --timeout=60 --timeout-method=signal.

signal rather than thread is the load-bearing choice: thread kills the process, so one deadlock still costs the rest of the run, whereas signal raises inside the blocked test — which then fails by name — and the suite continues. Measured on the known-deadlocking THORChain file:

1 failed, 5 passed in 20.29s

The stack dump points straight at the blocked read:

File "../keepkeylib/transport_udp.py", line 60, in _raw_read
    data = self.socket.recv(64)
+++++++++++++++++++++++++++++++++++ Timeout ++++++++++++++++++++++++++++++++++++

60s is roughly 30x the slowest healthy file in this suite (multisig, ~2s), so a genuinely slow test is not at risk.

The interesting part: the deadlock was hiding 22 failures, not 2

Every one is an intentional change in this release meeting a stale expectation. None indicates a firmware defect.

count	cause
14	AdvancedMode policy gate — TON, TRON and ETH contract data now require it (the documented BREAKING change). These tests never enable it.
5	chain_id refusal — #445 working as designed. Fixed by keepkey/python-keepkey#215.
2	the deadlocks — THORChain and EOS extra disclosure screens.
1	a CallException still to be triaged individually.

By file: TestMsgTonSignTx 9, TestMsgEthereumSigntx 5, TestMsgTronSignTx 3, and one each in TestMsgEosSignTx, TestMsgEthereum0xtxERC20, TestMsgThorChainSignTx, TestMsgEthereumSignTypedDataHash, TestMsgE712Verify.

That inventory did not exist before this change — the job died before producing it.

Scope

This does not fix the expectation mismatch. It makes it legible in two minutes with a test name attached instead of an opaque half-hour timeout, and it is worth keeping afterwards regardless: an integration test should never be able to consume the whole CI budget because one side is waiting for a button acknowledgement the other forgot to send.

It will not turn the branch green. 22 tests still fail, correctly. Combined with the aggregate gate from #474, release/7.14.2 will now report red for a legible reason, which is the point.

Verified

pytest-timeout 2.1.0 installs cleanly in the pinned Alpine 3.8 / Python 3.6.9 image. Both phases of python-keepkey-tests.sh carry the flags; sh -n clean.