fix(ci): resolve 27 hypatia workflow-hygiene findings (gitbot-fleet#249)

Triggered by the hypatia scan comment on PR #249 (98 findings; this PR
clears the 27 fixable workflow + config findings, plus the ~9 CSA001
mirrors that resolve via the source findings).

Findings resolved:
- 1× unpinned_action — pin governance.yml `@main` → SHA pin matching
  estate convention (live standards main 3b3549e2 with date comment).
- 23× missing_timeout_minutes — 16 workflow files, every job +
  reusable-workflow caller gets `timeout-minutes:` (10-60 min depending
  on job nature: 60 for codeql + mirror + supervised-scan, 30 for
  most scans, 10-15 for small jobs).
- 1× codeql_missing_actions_language / 1× StaticAnalysis (same finding,
  two presentations) — drop `javascript-typescript` (not in repo); add
  `actions` to cover the GitHub Actions surface.
- 1× scorecard_publish_with_run_step (HIGH severity) — split
  scorecard-enforcer.yml into action-only `scorecard` job + downstream
  `score-gate` job that pulls the SARIF as artifact. Keeps the OpenSSF
  publish protocol clean per hypatia's expectation.
- 1× secret_action_without_presence_gate (HIGH severity) — gate
  instant-sync.yml's FARM_DISPATCH_TOKEN usage with
  `env.HAS_TOKEN == 'true'` job-level env. Adds an explicit skip-notice
  step for the path where the token is absent (forks / PRs from forks).

Out of scope for this PR (separate work, will file issues):
- 6× SD004 (.machine_readable/*.a2ml in wrong location) — hypatia rule
  is enforcing a retired layout per the standards CLAUDE.md: canonical
  location IS `.machine_readable/` directly, not `.machine_readable/6a2/`.
  Filing hypatia issue to fix the stale rule.
- 29× expect_in_hot_path — Rust `.expect()` calls across bots/*. Needs
  per-bot review + migration to `?` or `.unwrap_or_else(...)`.
- 1× GS007 — 3 non-main remote branches. Cleanup separate.
- 33× CSA001 + 1× CSA002 — code-scanning-API mirrors of other findings.
  Clear automatically when sources clear.

Test plan: hypatia scan should drop from 98 → ~38 findings on next run
(or lower as CSA001 mirrors clear), no critical/high remaining in the
workflow surface.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -110,6 +111,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    timeout-minutes: 10
     steps:
       - name: Deploy to GitHub Pages
         id: deployment

.github/workflows/codeql.yml

@@ -23,14 +23,18 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
       security-events: write
     strategy:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # `actions` covers GitHub Actions workflow analysis (the primary
+          # surface this repo presents) — Hypatia StaticAnalysis flagged
+          # the prior matrix as containing no language present in the repo.
+          - language: actions
             build-mode: none
           - language: rust
             build-mode: none

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -115,6 +117,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -179,6 +182,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
@@ -239,6 +243,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check]
     if: always()
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository

.github/workflows/e2e.yml

@@ -11,6 +11,7 @@ jobs:
   e2e:
     name: E2E tests
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Install PyYAML (for workflow YAML validation)

.github/workflows/governance.yml

@@ -31,4 +31,5 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@main
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@3b3549e293f87be99d7dbb939d380c8128842c8e # main 2026-06-02
+    timeout-minutes: 30

.github/workflows/hypatia-dispatch-intake.yml

@@ -16,6 +16,7 @@ permissions:
 jobs:
   intake:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout gitbot-fleet
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

.github/workflows/hypatia-scan.yml

@@ -27,3 +27,8 @@ jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
     secrets: inherit
+    # Total caller-side wall-clock cap for the reusable. Matches
+    # Hypatia's `missing_timeout_minutes` rule expectation. The scan is
+    # typically ~3 min; the cap leaves headroom for slow estate builds.
+    timeout-minutes: 30
+

.github/workflows/instant-sync.yml

@@ -14,8 +14,17 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Presence-gate the FARM_DISPATCH_TOKEN secret. Without this, forks /
+    # PR-from-fork runs reach the dispatch step with an empty token and
+    # fail with an opaque 401 — see hypatia `secret_action_without_presence_gate`.
+    # Hoisted to job-level so the gate covers any future steps that also
+    # consume the secret.
+    env:
+      HAS_TOKEN: ${{ secrets.FARM_DISPATCH_TOKEN != '' }}
     steps:
       - name: Trigger Propagation
+        if: env.HAS_TOKEN == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
@@ -30,4 +39,9 @@ jobs:
             }
 
       - name: Confirm
+        if: env.HAS_TOKEN == 'true'
         run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
+
+      - name: Skip-reason notice
+        if: env.HAS_TOKEN != 'true'
+        run: echo "::notice::FARM_DISPATCH_TOKEN unavailable in this context — propagation skipped (expected on forks / PRs from forks)."

.github/workflows/learning-loop.yml

@@ -14,6 +14,7 @@ jobs:
   process-findings:
     name: Process Findings and Generate Rules
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     permissions:
       contents: write  # For creating rule proposal PRs
@@ -72,6 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: process-findings
     if: false  # Enable after manual approval workflow is ready
+    timeout-minutes: 10
 
     steps:
       - name: Placeholder for rule deployment