cpuBombIsBoundedByExecutionTimeout

The CPU-bomb defense (#965): a kernel spinning forever on a backward branch — no calls, so nothing yields voluntarily — must be terminated near WasmSandboxConfig.executionTimeout and surface WasmExecutionException naming the exceeded budget, never hang the host. The guest burns real wall-clock CPU, so the runTest timeout cannot pre-empt it; only the impl's own bound can.