ci(workflows): timeout-minutes on all jobs + fix two malformed workflows (#361)

## What

Fixes the genuine, root-cause CI/CD workflow-hygiene problems across the
**whole tree (383 workflow files)**, in response to the Hypatia scan's
`workflow_audit` findings.

### 1. `missing_timeout_minutes` — fixed at root
Added `timeout-minutes` to **every `runs-on` job** that lacked one,
across all workflows in the repo and its embedded sub-projects. Jobs
that *call a reusable workflow* (`uses:`) are correctly excluded —
`timeout-minutes` is invalid on those. Values: 15–20m for fast policy
jobs, 20–30m for build/test/analyze-heavy jobs.

### 2. Two genuinely malformed workflows — fixed
Both were **invalid YAML** that GitHub could not parse (latent, since
they don't run on PRs):
- **`boj-build.yml`** — the `K9-SVC Validation` and `Contractile Check`
steps were outdented to sequence items directly under `jobs:`. Removed
them (redundant with the governance + hypatia workflows, and they
referenced a non-canonical `lust` contractile — the canonical set is
must/trust/dust/intend/adjust/bust), restoring the file to its one
documented purpose: triggering the BoJ server.
- **`changelog-reusable.yml`** — a multi-line `git commit -m "…"` body
and a `gh pr create --body "…"` had continuation lines at column 0
inside a `run: |` block, terminating the block scalar early. Rewrote as
multiple `-m` flags / a single-line body.

## Verification
- All **383** workflow files parse cleanly (PyYAML); **0** `runs-on`
jobs remain without `timeout-minutes`.
- Diff is **workflow-files only** (+703 / −38; deletions = the two
malformed-file fixes).

## Not changed (and why)
- **`unpinned_action` findings are false positives.** Every `uses:`
across all 383 files is pinned to a full 40-hex SHA (e.g.
`actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd`). Hypatia's
own rule treats a 40-hex SHA as pinned; it's truncating the SHA to
`@de0f` in the report and mis-flagging correctly-pinned actions. Nothing
to fix in-repo — this is a scanner-side bug worth raising upstream.
- **One workflow carries an `AGPL-3.0-or-later` SPDX header** (repo is
MPL-2.0). That's licence drift, which is **flag-only** per the
manual-only licence guardrail — surfaced here, not edited.
- The Hypatia scan is **advisory/non-gating**; CI was already green.
This PR reduces the real finding count and removes two latent broken
workflows.

https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28

---
_Generated by [Claude
Code](https://claude.ai/code/session_01AmPXB2dA2wCcabo8BXwS28)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -18,6 +18,7 @@ permissions:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}
     steps:
       - name: Checkout
@@ -46,32 +47,3 @@ jobs:
             -H "Content-Type: application/json" \
             --data "$payload" \
             || echo "BoJ server unreachable - skipping (non-fatal)"
-
-  - name: K9-SVC Validation
-    run: |
-      echo "Running K9-SVC contractile validation..."
-      if [ -f .machine_readable/contractiles/must/Mustfile.a2ml ]; then
-        echo "✅ Mustfile found - running validation"
-        # Placeholder for actual K9 validation
-        echo "K9 validation would run here"
-      else
-        echo "❌ Mustfile not found"
-        exit 1
-      fi
-      
-  - name: Contractile Check
-    run: |
-      echo "Checking contractile completeness..."
-      contractiles=("must" "trust" "dust" "lust" "adjust" "intend")
-      missing=0
-      for c in "${contractiles[@]}"; do
-        if [ ! -f ".machine_readable/contractiles/$c/${c^}file.a2ml" ]; then
-          echo "❌ Missing: $c"
-          missing=$((missing + 1))
-        fi
-      done
-      if [ $missing -gt 0 ]; then
-        echo "❌ $missing contractiles missing"
-        exit 1
-      fi
-      echo "✅ All contractiles present"

0-ai-gatekeeper-protocol/.github/workflows/codeql.yml

@@ -15,6 +15,7 @@ permissions: read-all
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       security-events: write

0-ai-gatekeeper-protocol/.github/workflows/hypatia-scan.yml

@@ -17,6 +17,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository

0-ai-gatekeeper-protocol/.github/workflows/instant-sync.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3

0-ai-gatekeeper-protocol/.github/workflows/jekyll-gh-pages.yml

@@ -26,6 +26,7 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -45,6 +46,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

0-ai-gatekeeper-protocol/.github/workflows/jekyll.yml

@@ -31,6 +31,7 @@ jobs:
   # Build job
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -59,6 +60,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: build
     steps:
       - name: Deploy to GitHub Pages

0-ai-gatekeeper-protocol/.github/workflows/mirror.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   mirror-gitlab:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.GITLAB_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -30,6 +31,7 @@ jobs:
 
   mirror-bitbucket:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -48,6 +50,7 @@ jobs:
 
   mirror-codeberg:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.CODEBERG_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -66,6 +69,7 @@ jobs:
 
   mirror-sourcehut:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -84,6 +88,7 @@ jobs:
 
   mirror-disroot:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.DISROOT_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -102,6 +107,7 @@ jobs:
 
   mirror-gitea:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.GITEA_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
@@ -120,6 +126,7 @@ jobs:
 
   mirror-radicle:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: vars.RADICLE_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4

0-ai-gatekeeper-protocol/.github/workflows/scorecard-enforcer.yml

@@ -14,6 +14,7 @@ permissions: read-all
 jobs:
   scorecard:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       security-events: write
       id-token: write  # For OIDC
@@ -52,6 +53,7 @@ jobs:
   # Check specific high-priority items
   check-critical:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
 

0-ai-gatekeeper-protocol/.github/workflows/scorecard.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   analysis:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       security-events: write
       id-token: write

0-ai-gatekeeper-protocol/.github/workflows/secret-scanner.yml

@@ -12,6 +12,7 @@ permissions: read-all
 jobs:
   trufflehog:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
         with:
@@ -24,6 +25,7 @@ jobs:
 
   gitleaks:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
         with:
@@ -37,6 +39,7 @@ jobs:
   # Rust-specific: Check for hardcoded crypto values
   rust-secrets:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: hashFiles('**/Cargo.toml') != ''
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4