ci: add timeout-minutes to the 4 reusable-workflow jobs that lacked it

Hypatia `missing_timeout_minutes` hygiene. Repos consume these workflows
via `uses:` and cannot set a job-level timeout themselves, so the fix
belongs here in the reusable workflows:

- hypatia-scan-reusable.yml   scan                       -> 20m
- scorecard-reusable.yml      scorecard                  -> 15m
- governance-reusable.yml     workflow-staleness         -> 10m
- governance-reusable.yml     validate-hypatia-baseline  -> 15m

mirror-reusable.yml and secret-scanner-reusable.yml already cover every
job. Closes the workflow-hygiene item for gossamer#77 and fixes every
estate consumer at once.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/governance-reusable.yml

@@ -18,6 +18,7 @@ jobs:
   workflow-staleness:
     name: Check Workflow Staleness
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       has_baseline: ${{ steps.check.outputs.has_baseline }}
     steps:
@@ -51,6 +52,7 @@ jobs:
     needs: workflow-staleness
     if: needs.workflow-staleness.outputs.has_baseline == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout caller repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/hypatia-scan-reusable.yml

@@ -13,6 +13,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/scorecard-reusable.yml

@@ -11,6 +11,7 @@ jobs:
   scorecard:
     name: Run Scorecard
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       security-events: write
       id-token: write