fix(workflow): cap Claude turns + forbid background/polling in upgrade-deps

Run 24545325671 showed the `Check upgrade dependencies` step stuck for
40+ minutes in a busy-wait loop: Claude had backgrounded `just build`
and was polling `ps aux | grep "just build"` / `pgrep` / `sleep` every
few seconds to check if it was done. Each poll was a full model
round-trip, so the session never ended even though no real work was
happening.

- Add a 200-turn cap via `--max-turns 200` so a runaway agent session
  can no longer burn an unbounded amount of Actions time.
- Add an explicit "Running long commands" rule to the prompt that
  forbids backgrounding (`&`, `nohup`, `disown`, etc.) and forbids
  polling with `ps`/`pgrep`/`sleep` loops. The Bash tool's 20-minute
  per-call timeout is plenty for `just build` and `pnpm test`, and
  foreground calls give Claude the exit code and output in one shot.

Author: fengmk2

.github/workflows/upgrade-deps.yml

@@ -112,11 +112,29 @@ jobs:
             If any of the three above fails, diagnose the root cause, fix it, and re-run
             the final validation. Do not exit with the task marked complete otherwise.
 
+            ### Running long commands (IMPORTANT)
+            Run every long-running command (`just build`, `pnpm bootstrap-cli:ci`,
+            `pnpm test`, `cargo check`, etc.) in the FOREGROUND — a single Bash tool call
+            that blocks until the command exits. The Bash tool already gives you a 20-minute
+            timeout per call, which is enough for these builds.
+
+            Do NOT do any of the following:
+            - Spawn a background process (`&`, `nohup`, `disown`, `setsid`, `screen`, `tmux`).
+            - Poll for process completion with `ps`, `pgrep`, `lsof`, `sleep` loops, or
+              repeated `ls` checks on build artifacts. Each polling Bash call costs a full
+              model round-trip and burns minutes without progress.
+            - "Monitor" a running build from a separate Bash call. If you want to know
+              whether a build succeeded, just run it in the foreground and read its exit
+              code and stdout/stderr in the single tool result.
+
+            If a foreground command legitimately hits the 20-minute Bash timeout, report
+            that and stop — do not start polling.
+
             ### Commit rule
             Do NOT run `git commit` or `git push`. A later workflow step commits every
             modified file for you.
           claude_args: |
-            --model opus --allowedTools "Bash,Edit,Replace,NotebookEditCell"
+            --model opus --max-turns 200 --allowedTools "Bash,Edit,Replace,NotebookEditCell"
           additional_permissions: |
             actions: read