#395 MEDIUM: No upper bound validation on timeout duration strings

shell_command.py:153-186 - ISO 8601 duration parsing has no max validation. Malicious workflow could specify P365D to hold resources indefinitely. Fix: Add max timeout validation (e.g., 24 hours).