Test/ci echidna hypatia fix (#338)

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- What does this PR do, and why? -->

Closes #

## Type of change

- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
- [ ] ✨ New feature (non-breaking change that adds functionality)
- [ ] 💥 Breaking change (would change existing behaviour)
- [ ] 🕳️ Soundness fix (fixes a checker/proof false-negative)
- [ ] 📖 Documentation
- [ ] 🧹 Refactor / tech debt (behaviour-preserving)
- [ ] ⚡ Performance
- [ ] 🔧 Build / CI / tooling

## How has this been verified?

<!-- Establish ground truth: which tool did you RUN, and what did it
report?
     Don't cite a status doc — cite the command and its output. -->

## Checklist

- [ ] My commits are **signed** (`git commit -S`).
- [ ] I ran the project's own checks/tests locally and they pass.
- [ ] New files carry the correct `SPDX-License-Identifier` (code/config
`MPL-2.0`,
      prose `CC-BY-SA-4.0`); I did not relicense existing files.
- [ ] Docs are updated, and no public claim now overstates what the code
does.
- [ ] I have not introduced a soundness hole (or I have flagged where I
might have).

## Notes for reviewers

<!-- Anything that needs special attention, follow-up, or context. -->

----
## Summary by Gitar

- **CI / Tooling:**
- Updated Hypatia workflow SHA and added `timeout-minutes` in
`.github/workflows/hypatia-scan.yml`
- Added CodeQL analysis timeout in `.github/workflows/codeql.yml` and
added `TEST_CI_ECHIDNA.md`

<sub>This will update automatically on new commits.</sub>

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Mistral Vibe <vibe@mistral.ai>

Author: 3 people

.github/workflows/hypatia-scan.yml

@@ -16,5 +16,6 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@6cd3772824e59c8c9affeab66061e25383544242
+    timeout-minutes: 10
     secrets: inherit

TEST_CI_ECHIDNA.md

@@ -1,5 +1,6 @@
 # CI Test for ECHIDNA
 
+// SPDX-License-Identifier: MPL-2.0
 // SPDX-License-Identifier: CC-BY-SA-4.0
 
 This is a test file to trigger CI workflows for echidna.