Bound a single attempt with attempt_timeout

[azeemshaik025]

Bound a single attempt with attempt_timeout

max_elapsed lives inside should_retry_after, which is only reached when an attempt returns.
An operation that hangs never returns, so the budget never applied. A dead TCP peer, a lost
response, a service that accepts your connection and then goes quiet: all produce a future that is
simply never ready, and the retry sat there forever.

That was not a missing feature so much as a broken promise — README.md said "give up after ~30s
total" and the crate did not do it. Measured before the fix: a 500 ms budget still running at 3
seconds, stopped only by an external tokio::time::timeout. After: gives up in 310 ms with
reason=max_elapsed.

retry(fetch)
    .attempt_timeout(Duration::from_secs(5), || MyError::Timeout)
    .max_elapsed(Duration::from_secs(30))
    .await?

The per-attempt bound is what makes the total budget enforceable at all: a timed-out attempt
returns control to the loop, so max_elapsed is finally consulted.

Why on_timeout is a closure

A timed-out attempt has no E, because the operation never returned one. Three ways out, and only
one is cheap for people who never use this:

option	cost
RetryError::error() -> Option<&E>	every caller unwraps an Option mid-match, forever, for a case most never hit
E: From<SomeTimeoutType>	a bound on the whole builder — rules out E = String and anyhow::Error, exactly what ADR006 fought to keep
on_timeout: impl Fn() -> E	one extra argument

Verified from outside the crate that the third stays a one-liner for every common error type —
io::Error is \|\| ErrorKind::TimedOut.into(). The builder is order-independent in both
directions, and the one-arg mistake a tokio::time::timeout user would make produces
error[E0061]: this method takes 2 arguments, not a generics wall.

Full reasoning, including why the deadline runs on the injected Clock and why there is no
blocking equivalent: ADR007.

Breaking

Retry and RetryFuture gain one type parameter, for the handler. retry(..) and every builder
method are unchanged, so this only affects code that names those types — storing one in a struct
field, say. A defaulted Q = NoTimeout was tried and does not work: NoTimeout cannot implement
Fn() -> E, so the no-timeout case would need a second, overlapping IntoFuture impl.

Also in this branch

• The docs stopped lying. lib.rs claimed "timeout and circuit breaking are planned" — timeout
  ships here, and the circuit breaker was built and deliberately not shipped. The "resilience
  toolkit" tagline and a one-item ## Tools list also still sold a toolkit the roadmap had already
  decided against.
• docs/ROADMAP.md lands on main. It was written on the circuit-breaker branch and stranded
  there, so the file recording what we refuse had never actually been on main.
• Two unreachable expect()s removed from the poll loop. It reached the timeout handler through
  an Option it had just proved was Some. Matching the deadline and its handler as a pair makes
  the arm that needs both the only one that can run.
• examples/retry.rs gains the case that motivated the feature: a call that never returns.

Verification

15 gates across all three feature configs (--all-features, default, blocking-only): tests,
clippy -D warnings, rustdoc -D warnings, and MSRV 1.85. 65 unit + 14 doctests. Both examples
run.