feat(ghidra): bound one procedure's decompile without closing the session (#5662)

* feat(ghidra): bound one procedure's decompile without closing the session

Fixes #5340

* fix(ghidra): report decompile limit as a request timeout

Keeps BinarySession from marking every Ghidra operation unavailable after one procedure's decompile reaches the limit, and names the MCP tool-call deadline in the remediation.

* fix(ghidra): budget the decompile limit and report cancellation-closed sessions

Adds REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS to the derived Codex/Kimi tool deadline and forwards it through setup. Marks a remote failure that settles after caller cancellation so the timeout projection no longer promises session reuse.

* fix(ghidra): align deadline bounds and cancellation outcomes

* refactor(ghidra): shorten deadline recovery guidance

* fix(mcp): clarify the scope of inferred decompile deadlines

* test(ghidra): verify deadline workflows and document measured costs

Separate failure and registration cases by their distinct contracts.
Record actual Linux Ghidra, CLI and MCP evidence with measured context,
elapsed time, CPU and memory, and explicit remaining coverage limits.

* docs(ghidra): pin integration and distinguish baseline format failures

* fix(ghidra): own failure lifecycle wording in the provider

* test(ghidra): budget timeout fixture generation before allocation

* fix(ghidra): align capability and traversal deadline guidance

* style(config): align deadline guidance formatting

* docs(ghidra): record capability and traversal verification

---------

Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>

docs/mcp-contracts.md

@@ -935,6 +935,13 @@ deadlines remain unchanged. Doctor reports an informational recommendation
 when a configured deadline is shorter than the known provider allowance. An
 explicit JEB upstream deadline (`REA_JEB_MCP_TIMEOUT_MS`, shared by catalog
 discovery and each tools/call) also contributes to that allowance.
+An explicit `REA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS` is added to the Ghidra startup
+allowance as a single-decompile estimate. A multi-function call needs a client
+deadline covering every attempted decompile plus other work; the static
+registration value does not bound an arbitrary batch or `trace_native_values`
+traversal. Split batches, use `decompile_all` limit/resume, or reduce the trace
+`max_functions` to select work for the whole-call deadline. Existing caller
+deadlines remain unchanged.
 
 For an already connected client using the pinned SDK, request options are the
 **second** argument of `callTool`: