ci(workflows): add timeout-minutes to all jobs; fix two malformed workflows

Resolves the genuine workflow_audit (missing_timeout_minutes) findings at root across the whole tree (383 workflow files):

- Add timeout-minutes to every runs-on job that lacked one (reusable-workflow-call jobs correctly excluded — the key is invalid there). 15-20m for fast policy jobs, 20-30m for build/test-heavy jobs.

- boj-build.yml: two steps (K9-SVC Validation, Contractile Check) were outdented to sequence items directly under jobs:, making the file invalid YAML. Removed them (redundant with governance/hypatia; referenced a non-canonical 'lust' contractile), restoring the file to its documented single purpose (trigger the BoJ server).

- changelog-reusable.yml: two multi-line shell strings (a git commit body and a gh pr --body) had continuation lines at column 0 inside a run: | block, terminating the block scalar early — invalid YAML. Rewrote as multiple -m flags / single-line body.

Note: Hypatia's unpinned_action findings are false positives — every uses: across all 383 files is pinned to a full 40-hex SHA (e.g. actions/checkout@de0fac2e...). Left unchanged.

https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28

Author: claude

.github/workflows/affinescript-verify.yml

@@ -39,6 +39,7 @@ jobs:
   verify:
     name: AffineScript Verify
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # advisory: see header note. continue-on-error keeps the
     # whole job advisory — including the compiler checkout/setup-ocaml/build
     # steps — so a toolchain/build problem cannot block merges or add

.github/workflows/boj-build.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
@@ -46,32 +47,3 @@ jobs:
             -H "Content-Type: application/json" \
             --data "$payload" \
             || echo "BoJ server unreachable - skipping (non-fatal)"
-
-  - name: K9-SVC Validation
-    run: |
-      echo "Running K9-SVC contractile validation..."
-      if [ -f .machine_readable/contractiles/must/Mustfile.a2ml ]; then
-        echo "✅ Mustfile found - running validation"
-        # Placeholder for actual K9 validation
-        echo "K9 validation would run here"
-      else
-        echo "❌ Mustfile not found"
-        exit 1
-      fi
-      
-  - name: Contractile Check
-    run: |
-      echo "Checking contractile completeness..."
-      contractiles=("must" "trust" "dust" "lust" "adjust" "intend")
-      missing=0
-      for c in "${contractiles[@]}"; do
-        if [ ! -f ".machine_readable/contractiles/$c/${c^}file.a2ml" ]; then
-          echo "❌ Missing: $c"
-          missing=$((missing + 1))
-        fi
-      done
-      if [ $missing -gt 0 ]; then
-        echo "❌ $missing contractiles missing"
-        exit 1
-      fi
-      echo "✅ All contractiles present"

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
@@ -91,6 +92,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/changelog-reusable.yml

@@ -54,6 +54,7 @@ jobs:
   generate:
     name: Generate CHANGELOG.md
     runs-on: ${{ inputs.runs-on }}
+    timeout-minutes: 15
     permissions:
       contents: write
       pull-requests: write
@@ -145,12 +146,10 @@ jobs:
             echo "Nothing to commit after move (race condition)."
             exit 0
           fi
-          git commit -m "chore(changelog): regenerate from conventional commits
-
-Auto-generated by hyperpolymath/standards changelog-reusable.yml.
-See standards/templates/cliff.toml for the canonical config.
-
-Closes part of the 2026-05-26 CHANGELOG gap (standards#197 audit)."
+          git commit \
+            -m "chore(changelog): regenerate from conventional commits" \
+            -m "Auto-generated by hyperpolymath/standards changelog-reusable.yml. See standards/templates/cliff.toml for the canonical config." \
+            -m "Closes part of the 2026-05-26 CHANGELOG gap (standards#197 audit)."
           git push origin HEAD:${{ github.ref_name }}
 
       - name: Mode = pr-back — open PR with regenerated CHANGELOG.md
@@ -174,9 +173,7 @@ Closes part of the 2026-05-26 CHANGELOG gap (standards#197 audit)."
           git push -u origin "$branch"
           gh pr create \
             --title "chore(changelog): regenerate from conventional commits" \
-            --body "Auto-generated by hyperpolymath/standards changelog-reusable.yml.
-
-Closes part of the 2026-05-26 CHANGELOG gap (standards#197 audit)." \
+            --body "Auto-generated by hyperpolymath/standards changelog-reusable.yml. See standards/templates/cliff.toml for the canonical config. Closes part of the 2026-05-26 CHANGELOG gap (standards#197 audit)." \
             --base "${{ github.ref_name }}" \
             --head "$branch"
 

.github/workflows/codeql-reusable.yml

@@ -76,6 +76,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ${{ inputs.runs-on }}
+    timeout-minutes: 20
     permissions:
       contents: read
       security-events: write

.github/workflows/codeql.yml

@@ -28,6 +28,7 @@ permissions:
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       security-events: write

.github/workflows/deno-ci-reusable.yml

@@ -48,6 +48,7 @@ jobs:
   deno-ci:
     name: Deno CI
     runs-on: ${{ inputs.runs-on }}
+    timeout-minutes: 15
     permissions:
       contents: read
     steps:

.github/workflows/doc-format.yml

@@ -22,6 +22,7 @@ jobs:
   check-doc-format:
     name: Check Documentation Format
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

.github/workflows/echidna-verify.yml

@@ -196,6 +196,7 @@ jobs:
     name: Trust pipeline summary
     needs: [agda-lol, idris2-a2ml, idris2-avow]
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     if: always()
     steps:
       - name: Summarise

.github/workflows/elixir-ci-reusable.yml

@@ -101,6 +101,7 @@ jobs:
   test:
     name: Compile + test
     runs-on: ${{ inputs.runs-on }}
+    timeout-minutes: 15
     # Guard on mix.exs so the wrapper is safe to add unconditionally.
     if: ${{ hashFiles(format('{0}/mix.exs', inputs.working_directory)) != '' }}
     permissions: