fix: bound Composio startup and forward Compose API key

[Twil3akine]

Fixes #152.

Summary

Make Composio startup respect Dot run cancellation and timeouts, and forward COMPOSIO_API_KEY into Docker Compose deployments.

Cause

Composio session creation/reuse and tool discovery ran before the inner agent started, but those requests did not receive the Dot run's abort signal.

If either startup request stalled, the turn timeout aborted the controller without settling the pending startup work, leaving the run stream open until that request eventually returned.

Separately, the server reads COMPOSIO_API_KEY, but compose.yml did not pass the value into the app container.

Fix

• Pass the Dot run abort signal to Composio session creation and session reuse.
• Pass the same signal to Composio tool discovery.
• Complete timed-out runs while Composio startup is still pending.
• Stop startup after explicit cancellation so the inner agent cannot begin later if the pending session request resolves.
• Preserve the existing behavior once normal agent execution has started.
• Forward optional COMPOSIO_API_KEY through the app service in compose.yml.

Regression coverage

Added coverage for:

• a stalled Composio session request reaching the turn timeout;
• stalled Composio tool discovery reaching the turn timeout;
• cancellation before session creation resolves;
• propagation of the abort signal through Composio SDK request options;
• Compose forwarding of COMPOSIO_API_KEY.

The integration remains optional: when connected apps are disabled or no Composio key is configured, existing behavior is unchanged.