ci: bump Claude Code to 2.1.301, cap usage-limit waits, WebFetch off under egress enforce

[aaronjmars]

Bumps the pinned Claude Code from 2.1.287 to 2.1.301 and uses two of its new switches.

Changes

1. Pin bump in aeon.yml and messages.yml (npm install line + cache key), the claude adapter rh-meta block, regenerated harnesses.json, README pins.
2. Claude adapter exports CLAUDE_CODE_RETRY_WATCHDOG=1 and CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS=600000 (10 min). A run that hits a usage limit whose reset is far away now ends in minutes instead of sitting until the 1800s run-harness guard. Operator-set values win.
3. Egress audit action sets CLAUDE_CODE_DISABLE_WEB_FETCH=1 only when EGRESS_MODE=enforce and the proxy is up, so WebFetch (Anthropic-side, never passes iron-proxy) cannot route around the allowlist. Audit mode unchanged. WebSearch has no such switch and still bypasses.

Fixes the fleet gains (2.1.288 to 2.1.301)

• Unattended runs resume a stream that timed out mid-reply instead of retrying for hours (gives up after three timeouts).
• Headless -p honors SIGTERM from timeout -k even when SIGCONT arrives with it.
• Streams through a custom ANTHROPIC_BASE_URL (every gateway arm) wait 300s with no data instead of being cut at 180s.
• Compaction loop behind a gateway fixed.
• --json-schema runs no longer exit non-zero on a success result when the connection drops after the structured output arrived; --tools now applies to built-in tools that register after launch.

Risk: claude -p now waits for background commands (2.1.292)

Before, -p killed a background command 5s after the final result. Now it waits for it. run-harness wraps the adapter in timeout -k 30 1800 (process-group TERM, then KILL), so a skill that leaves a background job running cannot hang the job past 30 min, but it would turn a finished run into a 124 timeout. I found no skill that does this today (fleet-control uses & + wait inside one Bash call). No guard added; if it shows up, the fix is a line in the skill prompt rules or a lower --timeout per skill.

Not touched: aeon-agent and miroshark-aeon pick this up through aeon-update.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}