Per-attempt timeout for kinds whose handle call sets none. Null, the default, means no cap: a handler runs until it returns, with its lease renewed by heartbeat the whole time. The timeout is independent of lease: the lease detects dead workers, the timeout bounds live ones.