fix(cloudfront): hold a function to a CPU-time budget, not wall-clock time

[vieiralucas]

Summary

cloudfront_test_function e2e tests needed a retry in 4 of the last 26 E2E runs. With #2520's retried-failure output, the first attempt's error is now on record, from test_function_echoes_request:

unexpected error: Some("function execution exceeded the 250ms time limit")

That handler is a trivial echo. It "exceeded" the limit because the limit was 250ms of wall-clock time on the caller, covering thread spawn, JS runtime setup, and any time a loaded CI runner simply didn't run the worker thread. Locally, setup takes 1-3ms even under full CPU load, which is why it never reproduced here.

Real CloudFront Functions are bounded by compute (~1ms of CPU per request), not elapsed time.

Change

crates/fakecloud-cloudfront/src/js_runtime.rs:

• The 250ms budget is CPU time on the worker thread. The worker hands the caller its CPU clock and starting reading as it starts (pthread_getcpuclockid on Linux, the thread's Mach port via thread_info on macOS; elapsed time on platforms with neither). The caller polls every 5ms and abandons the run with the same exceeded the 250ms time limit error the moment the budget is spent, so a CPU-bound handler is still cut off at ~250ms. The worker re-checks its own CPU time when it finishes, for a run that crossed the budget between polls; that path keeps the handler's logs.
• Nothing is charged before the worker starts. A thread the host is slow to schedule has used no compute.
• A 5s wall-clock safety net (was the 250ms limit itself) abandons a run that never reports back.
• ComputeUtilization is derived from the same CPU time.
• The wait runs off the async runtime. TestFunction / TestConnectionFunction are async and await the runner through spawn_blocking, so a stalled worker cannot pin a tokio worker thread for the safety-net duration; their state lock is scoped so no guard crosses the await.

boa's loop-iteration and recursion caps are unchanged and still stop while(1){}.

Surfaces

• Docs: website/content/docs/services/cloudfront.md describes the compute budget and safety net.
• No API shape, SDK, conformance or count change. libc added as a cfg(unix) dependency of fakecloud-cloudfront (already in the lockfile).

Test plan

New unit tests in js_runtime.rs, each checked to fail against the behavior it guards:

Test	Guards	Fails when
a_cpu_bound_handler_is_cut_off_at_its_budget	catastrophic regex backtracking (no loop iterations, so boa's caps never trip) returns in ~0.26s	watchdog check disabled: waits the full 5s
a_worker_slow_to_start_is_not_charged_for_the_wait	a worker delayed longer than the whole budget still runs a trivial handler	pre-start wall time charged: exceeded the 250ms time limit
a_descheduled_thread_accrues_no_compute	a sleeping thread uses none of the budget	thread CPU clock replaced by elapsed time
waiting_on_a_handler_leaves_the_runtime_free	a current-thread tokio runtime keeps ticking while a handler runs to its budget	runner called directly: 0 ticks
a_run_over_its_compute_budget_reports_the_time_limit, a_worker_that_does_not_report_back_hits_the_wall_clock_safety_net, busy_work_accrues_compute	budget, safety net, clock

• fakecloud-cloudfront: 81/81 tests; cloudfront_test_function e2e 4/4; clippy -D warnings and fmt clean.
• The Linux clock path is compiled and exercised by CI (only macOS was available locally).

---

Summary by cubic

Holds CloudFront Function test handlers to a CPU-time budget instead of wall-clock time, fixing false failures on loaded CI runners where a trivial echo handler exceeded the old 250ms elapsed-time limit.

• The 250ms limit is now computed on the worker thread (via thread CPU clocks on Linux/macOS, elapsed time elsewhere), so scheduling delays don't count against it.
• A 5s wall-clock safety net replaces the old 250ms wall-clock timeout for runs that never report back.
• The wait runs off the async runtime via spawn_blocking, so a stalled worker no longer pins a tokio worker thread.
• ComputeUtilization is derived from the same CPU time.
• Docs updated to describe the compute budget and safety net.

^{Written for commit f32caab. Summary will update on new commits.}