Add optional exec websocket keepalive with lifecycle safeguards

[davidgamero]

reimplements #2878 with its review feedback

changes on top of 2878

• validate intervals before connecting so invalid options cannot start a remote command
• reject oversized intervals
• skip keepalive unless the socket is open and supports ping and listener registration/removal
• remove all keepalive listeners on close/error and stop the timer if the socket is no longer open
• unref the timer so it cannot keep node running
• replace sleep-based coverage with deterministic timer tests and add a real websocket ping/pong test

ai disclosure: opencode and gpt6

[brendandburns]

/lgtm
/approve

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, davidgamero

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [brendandburns,davidgamero]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment