ci: harden workflows — timeout caps, pinned+verified elan, drop empty CodeQL lang

Follow-up to the #151/#152 proof work, addressing the Hypatia workflow findings
and the CodeQL javascript-typescript configuration-error failure. Scoped to CI
hygiene only — no licence changes, no removal of security workflows, no
un-pinning of actions.

CodeQL (fixes the `analyze (javascript-typescript, none)` failure):
- Drop `javascript-typescript` from the analysis matrix. The repo has zero JS/TS
  sources (TypeScript/Node are banned by the language policy), so the extractor
  found no code and the job failed with a configuration error. `cpp` (real C
  sources: Elixir NIF, OCaml/Lean wrapper, Zig FFI) is kept and passes.

Download integrity (Hypatia `download_then_run`, high):
- lean-verification.yml + rust-cli.yml installed Lean via `curl … | sh`. Now the
  elan installer is pinned to an immutable tag (v3.1.1), downloaded to a file,
  SHA-256-verified, then executed — no pipe-to-shell.

Timeout caps (Hypatia `missing_timeout_minutes`, medium):
- Add `timeout-minutes` to all 31 runs-on jobs that lacked one, across 16
  workflows (reusable `uses:` jobs are correctly left alone — GitHub disallows
  timeout-minutes there). Tiered: 15 for light check/validate/notify jobs, 30
  for build/test/proof jobs, 45 for verify-idris2 (cold cache bootstraps Idris2
  from source), 60 for cflite_batch (30-min fuzz budget + build/upload overhead).

All workflows re-validated as parseable YAML; 0 runs-on jobs remain without a
timeout cap.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KfgJznd6jzSeDYsSXGAXkU

Author: claude

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.2

.github/workflows/bridge-forbidden-phrases.yml

@@ -33,6 +33,7 @@ jobs:
   check:
     name: docs/ECHO-TYPES-OCHRANCE-BRIDGE forbidden-phrases
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
       - name: Run forbidden-phrases checker

.github/workflows/casket-pages.yml

@@ -18,6 +18,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -91,6 +92,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/cflite_batch.yml

@@ -18,6 +18,9 @@ permissions:
 jobs:
   batch_fuzzing:
     runs-on: ubuntu-latest
+    # 30 min fuzzing (fuzz-seconds: 1800) + build/upload overhead per sanitizer,
+    # so the cap must sit above the fuzz budget.
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:

.github/workflows/cflite_pr.yml

@@ -19,6 +19,7 @@ permissions:
 jobs:
   pr_fuzzing:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:

.github/workflows/codeql.yml

@@ -31,8 +31,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
-            build-mode: none
+          # Only languages actually present in the tree. `javascript-typescript`
+          # was removed: the repo contains zero JS/TS sources (TypeScript/Node
+          # are banned by the language policy), so CodeQL's JS/TS extractor
+          # found no code and the job failed with a configuration error. `cpp`
+          # covers the real C sources (Elixir NIF, OCaml/Lean wrapper, Zig FFI).
           - language: cpp
             build-mode: none
 

.github/workflows/compilation_tests.yml

@@ -35,6 +35,7 @@ jobs:
   test_matrix:
     name: Test (${{ matrix.rust }} on ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -95,6 +96,7 @@ jobs:
   test_msrv:
     name: Test MSRV (1.88.0)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -115,6 +117,7 @@ jobs:
   test_features:
     name: Test Features
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -147,6 +150,7 @@ jobs:
   cross_compile:
     name: Cross-compile (${{ matrix.target }})
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -178,6 +182,7 @@ jobs:
   lint:
     name: Lint (clippy + rustfmt)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -203,6 +208,7 @@ jobs:
   docs:
     name: Build documentation
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
@@ -225,6 +231,7 @@ jobs:
   build_release:
     name: Build release artifacts
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
       matrix:
         include:

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -66,6 +67,7 @@ jobs:
   k9-validate:
     name: Validate K9 contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -115,6 +117,7 @@ jobs:
   empty-lint:
     name: Empty-linter (invisible characters)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -179,6 +182,7 @@ jobs:
   groove-check:
     name: Groove manifest check
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -237,6 +241,7 @@ jobs:
   eclexiaiser-validate:
     name: Validate eclexiaiser manifest
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - name: Checkout repository
@@ -316,6 +321,7 @@ jobs:
   dogfood-summary:
     name: Dogfooding compliance summary
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
     if: always()
 

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -23,6 +23,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     outputs:
       digests: ${{ steps.hash.outputs.digests }}
 

.github/workflows/hypatia-scan.yml

@@ -43,6 +43,7 @@ jobs:
   scan:
     name: Hypatia Neurosymbolic Analysis
     runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository