ci: add timeout-minutes to standalone workflow jobs

Addresses the Hypatia workflow-audit `missing_timeout_minutes` findings on
the jobs that can carry a job-level timeout:

- casket-pages.yml: build (15m), deploy (10m)
- codeql.yml: analyze (30m)
- hypatia-scan.yml: scan (20m)

The reusable-workflow callers (governance.yml, mirror.yml, scorecard.yml)
are intentionally left untouched: GitHub does not permit `timeout-minutes`
on a job that uses `uses:`. governance.yml's `@main` reference is also left
as-is — mirror/scorecard are SHA-pinned but governance is deliberately kept
on main by the maintainer.

Author: claude

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -91,6 +92,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/codeql.yml

@@ -15,6 +15,7 @@ jobs:
   analyze:
     name: CodeQL Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       security-events: write
       contents: read

.github/workflows/hypatia-scan.yml

@@ -43,6 +43,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository