check-inbox hook has no timeout and swallows decode errors

[d0ugal]

Bug

Two issues in `internal/cli/check_inbox.go`:

1. No timeout: The frame-reading loop has no deadline. If the daemon streams frames slowly or the connection hangs, this hook blocks the agent's SessionStart indefinitely.

2. Swallowed decode error (line 50): `msg, _ := protocol.DecodeControl(frame.Payload)` — a malformed frame produces a zero-value Envelope with `Type: ""`. The switch falls through without matching, and the loop continues waiting for a `msg_done` that was already garbled.

Suggestion: Add a context timeout (e.g. 5 seconds) for the entire operation, and break/log on decode errors.

Found by: Claude (review tribunal)

[d0ugal]

Partially addressed; core issue remains. DecodeControl errors are now ignored rather than mishandled (internal/cli/check_inbox.go:53), but the frame-reading loop (lines ~42-65) still has no deadline/timeout, so a slow or hung daemon can block the agent's SessionStart hook indefinitely. Also no default case in the message-type switch to break on malformed frames. Fix: add a socket/loop deadline (e.g. 5s) and a default case.