ci(workflows): add job-level timeout-minutes (clear Hypatia workflow_audit batch)

[hyperpolymath]

Add job-level timeout-minutes across workflows

Clears the recurring Hypatia missing_timeout_minutes (workflow_audit, medium-severity) findings that have been posting on every PR. Adds a job-level timeout-minutes to every normal job — 23 jobs across 11 workflows.

Values (generous upper bounds — cap runaway jobs, don't affect normal runs)

timeout	workflows
10	boj-build, instant-sync
15	dogfood-gate (×6), rhodibot, scorecard-enforcer (×2)
30	codeql, casket-pages (×2), hypatia-scan, release (×3), static-analysis-gate (×4), cross-platform

Intentionally not touched — reusable-workflow callers

governance.yml, mirror.yml, scorecard.yml, secret-scanner.yml are thin jobs that call a reusable workflow via uses:. GitHub rejects timeout-minutes on such jobs — the timeout has to live in the called workflow (in hyperpolymath/standards), which is outside this repo. Adding it here would make the workflows invalid, so those four are left as-is.

Verification

• All edited workflows parse (the only PyYAML hiccup is a pre-existing one in dogfood-gate.yml's embedded python3 -c block — present identically on main, unrelated to this change; GitHub's and Hypatia's parsers read it fine, which is why Hypatia flagged its jobs).
• Every timeout-minutes is at the 4-space job level; counts match job counts exactly; the four caller files have zero.

Scope notes

• This addresses the medium missing_timeout_minutes batch only. The 2 critical / 15 high Hypatia findings aren't itemised in the advisory comment and would need the SARIF/artifact detail to triage — separate follow-up.
• The Hypatia scan is advisory (non-gating by design per hypatia-scan.yml), so this is hygiene, not a merge-blocker.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LvsZgNxFbeqfRmrVFNhJ8G

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 54 issues detected

Severity	Count
🔴 Critical	2
🟠 High	15
🟡 Medium	37

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "scorecard_wrapper_missing_job_permissions",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/game-server-admin/game-server-admin/src/gui/fli/fli-tooltip.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/game-server-admin/game-server-admin/src/gui/fli/fli-editable.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (2 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/game-server-admin/game-server-admin/src/gui/fli/fli-terminal.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (4 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/game-server-admin/game-server-admin/src/gui/fli/fli-gauge.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Deno -A grants all permissions -- use specific --allow-* flags (4 occurrences, CWE-250)",
    "type": "js_deno_all_perms",
    "file": "/home/runner/work/game-server-admin/game-server-admin/run.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/game-server-admin/game-server-admin/.machine_readable/svc/k9/template-hunt.k9.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence