Wrap each outbox mutation's execution in a per-item timeout raced against
the shutdown signal, so one hung remote op (a stuck IMAP/JMAP call or
webhook) can no longer freeze delivery for every other pending mutation
across every account. A timed-out item is dispositioned exactly like any
other transient failure: retryable, bumping retry_count, never completed.
Refs #290