The advertised decision deadline ties with the OPA timeout, so a slow OPA proceeds #269

The Guardian advertises a decision deadline that is no longer than its own policy evaluation deadline, so when OPA is slow the host gives up first and the fail-closed deny never arrives.

packages/guardian/src/handshake.ts:82 sets DEFAULT_TIMEOUT_MS = 5000, and the host adapter uses that value as its deadline (packages/host-adapter/src/failure-posture.ts:73 has the same default). The pinned AGT SDK runs OPA as a subprocess with a 5s default timeout. The host starts its timer before the Guardian even spawns OPA, so on a hung or slow OPA the host always times out first, and under the default proceed posture the tool runs. The SDK's policy_invocation_failed deny then shows up after the host has moved on. Setting ACS_OPA_TIMEOUT_MS higher, as the Rust port's README does with 30000, makes the gap wider.

Suggested fix: advertise the OPA timeout plus a margin (about one second), or refuse to start when the OPA timeout isn't below the advertised default_ms. Add a test that pairs the two values.

The same pair exists in the Rust port (PR #187) and in the Go port (PR #169, opa_timeout and decision_timeout both 5s in guardian.yaml). Both reviews ask for the same fix there.