ci: add timeout-minutes safety bound to every workflow steps-job

Rescues the one piece of unmerged value from the stale pr-183 branch (53
commits behind main) by re-applying it fresh against the current workflow
set. A cherry-pick would have failed: several of pr-183's targets
(governance, rust-ci, scorecard, ...) have since become reusable-workflow
callers, where timeout-minutes is invalid.

Adds timeout-minutes to all 37 steps-based (runs-on) jobs across 18
workflows that lacked one (including the new dogfood-proofs-ci.yml).
Pure insertions, no other changes; reusable-caller (uses:) jobs are
skipped. Values follow pr-183's per-workflow scale. Closes the
missing_timeout_minutes class Hypatia flags.

Tracker: #238

https://claude.ai/code/session_01UAqDQaMwpUqWHUSZekGZWv

Author: claude

.github/workflows/agda-meta-checker.yml

@@ -28,6 +28,7 @@ jobs:
   verify-proofs:
     name: Type-check Agda proofs
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

.github/workflows/boj-build.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/cargo-audit.yml

@@ -27,6 +27,7 @@ jobs:
   audit:
     name: Dependency audit
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository

.github/workflows/cflite_batch.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:

.github/workflows/cflite_pr.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   PR:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

.github/workflows/chapel-ci.yml

@@ -59,6 +59,7 @@ jobs:
   chapel-build:
     name: Compile Chapel Metalayer
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -110,6 +111,7 @@ jobs:
   zig-ffi:
     name: Build & Test Zig FFI Bridge
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
@@ -138,6 +140,7 @@ jobs:
   rust-chapel-feature:
     name: Rust Build with Chapel Feature
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     needs: zig-ffi
     continue-on-error: true
     steps:
@@ -176,6 +179,7 @@ jobs:
   rust-chapel-real:
     name: Rust Build — Real Chapel Library (allow-fail, L2.3+ gate)
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
     needs: [chapel-build, zig-ffi]
     continue-on-error: true
     steps:

.github/workflows/container-ci.yml

@@ -53,6 +53,7 @@ jobs:
   container-build:
     name: Build & verify container image
     runs-on: ubuntu-latest
+    timeout-minutes: 90
 
     steps:
       - name: Checkout
@@ -110,6 +111,7 @@ jobs:
   tier3-container:
     name: Tier-3 / ${{ matrix.prover }}
     runs-on: ubuntu-latest
+    timeout-minutes: 90
     # Run on schedule or when the .containerization tree changes on main.
     # Not a merge gate — these are informational weekly builds.
     if: >-

.github/workflows/dogfood-gate.yml

@@ -28,6 +28,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -72,6 +73,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -121,6 +123,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -185,6 +188,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -243,6 +247,7 @@ jobs:
   eclexiaiser-validate:
     name: Validate eclexiaiser manifest
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -312,6 +317,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
     if: always()
 

.github/workflows/dogfood-proofs-ci.yml

@@ -39,6 +39,7 @@ jobs:
   coq:
     name: Coq
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -65,6 +66,7 @@ jobs:
   lean:
     name: Lean 4
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -116,6 +118,7 @@ jobs:
   agda:
     name: Agda
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 

.github/workflows/formal-verification.yml

@@ -43,6 +43,7 @@ jobs:
   stable-tests:
     name: Trust-pipeline invariant tests (stable)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -67,6 +68,7 @@ jobs:
   creusot-verify:
     name: Creusot formal verification
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # No continue-on-error — this is a hard merge gate as of Stage 8c-M3.
     # The outer-loop invariant for compute is now live; all obligations
     # (PO-1..P8, PO-A1..A12) must discharge under Why3+Z3.