Runaway query: a cartesian query exhausts memory and is OOM-killed before the query timeout fires #296

From the engine production-readiness audit (2026-10-05). A single authenticated cartesian query (?a(X), b(Y), 30K x 30K) on shipped defaults drove the server to its memory ceiling and was OOM-killed; the 30 s query_timeout never fired and client disconnect did not free memory. Measured on f2e5ab2 (before #275's memory limits). Causes: cancellation polled only between worker.step() calls; antijoin loop has no should_stop; deadline returns without stopping the compute thread (permit held); max_result_rows bounds output not intermediates; max_query_cost defaults to 0 (off). Fix: re-verify on current main with #275, then non-zero default max_query_cost + warning, runtime budget on intermediates, sub-step cancellation incl. antijoin, hard-stop deadline that frees the permit only when the thread exits, fixpoint-iteration ceiling.