claim TTL + heartbeat: crashed agents must not hold locks forever

[Arrmlet]

Problem

Both are listed in README limitations today:

1. A claim has no TTL — if the claiming agent crashes, the step is locked until a human runs complete --force.
2. The agent heartbeat is written once at init and never refreshed, so agents shows who registered, not who's alive.

Proposal

• claim --ttl <seconds> writes expires_at into claim.json.
• Readers treat an expired claim as pending again — preserving the existing crash-window invariant (claim.json present + status.json missing = in_progress by the claimer) for unexpired claims.
• Takeover of an expired claim uses a conditional delete (If-Match on the stale claim's ETag) so two waiting agents can't both seize it. S3-compatible backends only; on HuggingFace takeover stays best-effort, same as claiming.
• Heartbeat refresh on every CLI call (cheap single put), so agents becomes trustworthy.
• Extend the contention benchmark with TTL-expiry races before calling it done.