reconcile: estate-standardization-20260607 onto main (preserve #34/#38 fixes) (#40)

## What

Reconciles the maintainer's **`estate-standardization-20260607`** branch
(the estate-standards catch-up) onto **current `main`**, resolving its
divergence + conflicts with the merged #34/#38 work — so `main` can
adopt the standardization without regressing recent fixes.

Brings onto main: the `svc/k9 → self-validating/` rename,
`bot_directives`, the contractiles refresh, governance docs, and flake
updates.

## Conflict resolutions (7 files)

| File(s) | Resolution | Why |
|---|---|---|
| `dependabot-automerge.yml`, `dogfood-gate.yml`,
`static-analysis-gate.yml`, `hypatia-scan.yml` | **take main** | main's
workflow layer has moved past the 6-day-old standardization (TruffleHog,
CodeQL `actions` extractor, hypatia-scan removal). `hypatia-scan.yml`
stays deleted — consistent with dropping the superseded
`hypatia-scan-reusable-wrapper` branch. |
| `contractiles/Justfile` (add/add) | take main | near-identical; main
is current. |
| `bust/Bustfile.a2ml`, `dust/Dustfile.a2ml` (modify/delete) | **keep
main's** | live, valued contractiles — not dropped. |

**Preserved from #34/#38** (auto-merged correctly): my **K9! magic +
pedigree** fixes carried through the `svc/k9 → self-validating` rename;
the **`ci.yml` grammar-guard `^data_` anchor**; the nightly-toolchain
`test` job.

## Verification

On the reconciled tree, run with the upstream actions:
- **`k9-validate-action` → 0 errors**
- **`a2ml-validate-action` → 0 errors**

The standardization touches **no Rust** (only `.machine_readable` /
workflows / flake / docs), so the code is main's, unchanged.

## Notes

- Draft — this reconciles a **maintainer-owned** standardization, so it
wants maintainer review. Once merged, the old
`estate-standardization-20260607` and the superseded
`chore/hypatia-scan-reusable-wrapper` branches can be deleted.
- CI is currently **billing-blocked** (jobs fail in 2–3s with no logs),
so this won't get a CI run until that's restored.

---
_Generated by [Claude
Code](https://claude.ai/code/session_018CaSgNjNURC7ocsyjYh9We)_

---------

Co-authored-by: Mistral Vibe <vibe@mistral.ai>
Co-authored-by: Claude <paraordinate@yahoo.co.uk>

Author: 3 people

.github/workflows/boj-build.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout

.github/workflows/casket-pages.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -96,6 +97,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/ci.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7
@@ -30,6 +31,7 @@ jobs:
         run: cargo fmt -- --check
   grammar-guard:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Grammar change detection

.github/workflows/codeql.yml

@@ -19,6 +19,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       security-events: write

.github/workflows/guix-nix-policy.yml

@@ -6,6 +6,7 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:

.github/workflows/k9-svc-validation.yml

@@ -6,6 +6,7 @@ permissions:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Validate contractiles

.github/workflows/npm-bun-blocker.yml

@@ -6,6 +6,7 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:

.github/workflows/openssf-compliance.yml

@@ -13,6 +13,7 @@ permissions:
 jobs:
   openssf-compliance:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:

.github/workflows/quality.yml

@@ -6,6 +6,7 @@ permissions:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:
@@ -32,6 +33,7 @@ jobs:
         continue-on-error: true
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:

.github/workflows/release.yml

@@ -15,6 +15,7 @@ jobs:
   build:
     name: Build Artifacts
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:
@@ -72,6 +73,7 @@ jobs:
   changelog:
     name: Generate Changelog
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     outputs:
@@ -112,6 +114,7 @@ jobs:
     name: Create GitHub Release
     needs: [build, changelog]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: write
     steps: