ci: bound core workflow runtime

[earayu]

Summary

• add explicit read-only token permissions to lint/unit and backend compat workflows
• add conservative job timeouts to lint/unit and backend compat jobs so stuck runners fail predictably

Validation

• ruby YAML parse for touched workflows
• git diff --check
• pre-commit make lint

Part of SRE task #15 infrastructure cleanup.