fix(ci): repair branch payload — remove invalid root-level timeout-minutes, pin TruffleHog jobs

- boj-build.yml, bridge-forbidden-phrases.yml: drop root-level
  timeout-minutes (invalid workflow key -> startup_failure; job-level
  timeouts already present)
- secret-scanner.yml + alkahest-shell-transmuter security-checks.yml:
  SHA-pin actions/checkout and trufflesecurity/trufflehog (was @v4/@main),
  add job timeout

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/boj-build.yml

@@ -1,6 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
 name: BoJ Server Build Trigger
-timeout-minutes: 30
 on:
   push:
     branches: [main, master]

.github/workflows/bridge-forbidden-phrases.yml

@@ -15,7 +15,6 @@
 # reusable.yml should pick up this rule for all bridge-tagged repos.
 
 name: Bridge Forbidden Phrases
-timeout-minutes: 30
 on:
   push:
     branches: [main, master]

.github/workflows/secret-scanner.yml

@@ -15,11 +15,12 @@ jobs:
     secrets: inherit
   trufflehog:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.3
         with:
           extra_args: --only-verified --fail

alkahest-shell-transmuter/.github/workflows/security-checks.yml

@@ -99,11 +99,12 @@ jobs:
           echo "No template placeholders found"
   trufflehog:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3.93.3
         with:
           extra_args: --only-verified --fail