fix(ci): add missing timeout-minutes to all jobs (Hypatia compliance)

Author: hyperpolymath

.github/workflows/architecture-enforcement.yml

@@ -109,6 +109,7 @@ jobs:
 
   verify-idris-build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # Docker pull (snazzybucket/idris2) + Idris2 totality check across all
     # Proven.Safe.* modules. Local oracle runs in ~8 minutes; 20-minute
     # budget covers cold cache and the occasional Docker Hub slowdown.

.github/workflows/casket-pages.yml

@@ -20,6 +20,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -111,6 +112,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/cflite_batch.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

.github/workflows/cflite_pr.yml

@@ -16,6 +16,7 @@ on:
 jobs:
   PR:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

.github/workflows/codeql.yml

@@ -25,6 +25,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
       security-events: write

.github/workflows/dogfood-gate.yml

@@ -24,6 +24,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -68,6 +69,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -117,6 +119,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -181,6 +184,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -239,6 +243,7 @@ jobs:
   eclexiaiser-validate:
     name: Validate eclexiaiser manifest
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -303,6 +308,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
     if: always()
 

.github/workflows/echidna-verify.yml

@@ -198,6 +198,7 @@ jobs:
     name: Trust pipeline summary
     needs: [agda-lol, idris2-a2ml, idris2-avow]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: always()
     steps:
       - name: Summarise

.github/workflows/idris2-ci.yml

@@ -185,6 +185,7 @@ jobs:
 
   docs:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     if: github.ref == 'refs/heads/main'
     # Reuses Idris2 cache from build job; docs generation is fast (~5 min).

.github/workflows/instant-sync.yml

@@ -17,6 +17,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3

.github/workflows/publish-crates.yml

@@ -25,6 +25,7 @@ jobs:
   publish:
     name: Publish Rust crate
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     defaults: