Merge nucleic/upbeat-opal-viper-cc8l into main

Sources/RunnerCore/Config.swift

@@ -140,6 +140,19 @@ public struct RunnerConfig: Codable, Sendable, Equatable {
 
         /// Ceiling on boot + DHCP lease + SSH readiness before a slot is
         /// declared dead and recycled.
+        ///
+        /// - Important: This must exceed the guest's *worst-case* time to become
+        ///   SSH-ready, not its typical one. A clone that is still booting when
+        ///   this expires is destroyed and replaced by another clone that starts
+        ///   from zero — and because the replacement adds load to an already
+        ///   contended host, the next boot is slower still. Set too tight, this
+        ///   is not a timeout but a livelock: the daemon boots forever and no
+        ///   runner ever registers.
+        ///
+        ///   A guest sharing an Apple Silicon host with other Virtualization
+        ///   guests can take several minutes to reach `sshd`, so the default is
+        ///   deliberately generous. A genuinely wedged guest still gets caught;
+        ///   it just takes longer to notice, which is the cheaper mistake.
         public var bootTimeoutSeconds: Int
 
         public init(
@@ -147,7 +160,7 @@ public struct RunnerConfig: Codable, Sendable, Equatable {
             pollIntervalSeconds: Int = 5,
             reconcileIntervalSeconds: Int = 300,
             jobTimeoutMinutes: Int = 120,
-            bootTimeoutSeconds: Int = 300
+            bootTimeoutSeconds: Int = 900
         ) {
             self.maxConcurrentVMs = maxConcurrentVMs
             self.pollIntervalSeconds = pollIntervalSeconds