Support progressive depth halving as a generic policy in `Prover.advance_proof`

[Stevengre]

kontrol#1141 adds --per-depth-timeout to kontrol prove: each attempt has a stall window of depth * per_depth_timeout seconds in which the proof must commit at least one new node, otherwise the attempt is killed and max_depth is halved (down to 1). In this review comment, @ehildenb suggested factoring this into Prover.advance_proof so it's a generic policy rather than per-tool code.