Blocking calls in async paths: audit thread::sleep and std::fs in tool paths, pick one convention

[Hmbown]

From the 0.9.14 refactor backlog.

• thread::sleep in production paths: cloud_dispatch.rs ~1613 (sandbox-ready poll loop), lane/src/runtime.rs ~1401 (10 ms), plus others outside tests. On the runtime they park a worker thread. Convert to tokio::time::interval with cancellation, or a notify on the resource itself. Audit first — some are already under spawn_blocking.
• ~30 non-test files mix async fn with std::fs:: (tools/file_search, read_media, terminal_session, revert_turn, tool_preparation, turn_loop helpers). Decide one convention and enforce it once: (a) tool I/O uses tokio::fs, or (b) execute_planned_tools runs handlers on the blocking pool (spawn_blocking per batch — 81 sites already use the pattern). (b) is the ponytail answer for tools that read big files.

Deliverable: the convention written down in docs plus the sites moved. Size: M.

[Hmbown]

Triage (v0.9.14 run, audit result — not in #6161): both named production sleeps are misclassified in this checkout — crates/lane/src/runtime.rs:1401 is inside a test, and crates/tui/src/cloud_dispatch.rs:1613 runs on a dedicated thread (dispatch_runner.rs:137), so neither parks a tokio worker. The convention half is implementable: write "tool I/O goes through spawn_blocking; std::fs inside an async fn is a bug" next to AGENTS.md, enforced by an allowlist. No production code change needed for the two named sites.

[Hmbown]

Both halves done on v0914-chunk2:

• Audit — the two named sleeps were misclassified (lane::runtime:1401 is inside a test; cloud_dispatch.rs:1613 runs on the dedicated dispatch thread). The sweep then found and fixed real violations in 47834cc66: work_graph::retry_lock, App::retry_lock, and the /clear-style lock retries now yield_now between attempts instead of parking a worker up to 100ms; TerminalInputPump::pause_for_child_terminal and filesystem calls reachable from async tool/UI/engine paths likewise moved off the workers.
• Convention — picked and written down: AGENTS.md carries the blocking-call convention (std::fs/std::process inside async paths go through tokio::fs/tokio::process or spawn_blocking; thread::sleep only on dedicated threads), enforced by scripts/check-blocking-calls-budget.py ratcheting the unprotected-site count.

Closing.