fix(ci): drop illegal timeout-minutes from scorecard caller (finish #65) (#66)

Follow-up to #65.

## Problem

#65 added the required caller permissions (clearing the *original*
`startup_failure` from missing `security-events`/`id-token`), but it
also copied `timeout-minutes: 15` from `rsr-template-repo`. That key is
**not permitted on a job that calls a reusable workflow** via `uses:` —
only `name/uses/with/secrets/needs/if/permissions` are allowed — so the
Scorecard run kept failing at startup.

Confirmed with `actionlint`:

> when a reusable workflow is called with \"uses\", \"timeout-minutes\"
is not available.

## Fix

Remove `timeout-minutes`. Keep the permissions block (the real fix) and
the concurrency guard. `actionlint` now passes clean.

## Upstream note

`hyperpolymath/rsr-template-repo`'s `scorecard.yml` carries the **same**
invalid `timeout-minutes` and needs the same fix — its own Scorecard run
is likely failing too.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/scorecard.yml

@@ -23,5 +23,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-      id-token: write
-    timeout-minutes: 15
+      id-token: write