v2: Bound live crawls and make watch partial-success

[jmcte]

Problem / intent

The privacy-preserving live audit on 2026-07-10 showed that drive status, drive errors, drive shared, drive recents, tags items, and watch --once can exceed a 12-second per-command budget on a real library. A crawler control plane must remain responsive even when one provider is large or unhealthy.

Acceptance criteria

• Give every crawl/provider invocation an explicit traversal and wall-clock budget.
• Preserve the distinction between scan budget, result limit, and total available rows.
• Return structured partial/timeout state with counts and next-action guidance rather than hanging.
• watch --once continues other providers when one provider times out and records a redacted error envelope.
• Default polling never performs an unbounded recursive walk.
• Add deterministic large-fixture and timeout tests for Drive, Finder tags, and watch.
• Extend the live audit to summarize total pass/empty/fail/timeout counts without printing payloads.

Validation

swift test
bash scripts/ci/run-fast-checks.sh
python3 scripts/live-command-audit.py --binary .build/debug/icloud-cli --timeout 12

Dependencies

• Provider ids and health states should align with v2: Define a versioned provider capability manifest #89.
• v2 reliability follow-up to closed cache/watch issue Add persistent local cache and watch mode for OpenClaw polling #23 and Drive issues Extend drive with sync-state reporting (downloaded / cloud-only / errors) #52/Extend drive with shared and recents views #70.