ci(workflows): add timeout-minutes (steps jobs only) + SHA-pin actions (clears Hypatia workflow_audit)

All steps-based jobs now have timeout-minutes: 60. Reusable-workflow
caller jobs are intentionally left without timeout-minutes (invalid on
those job types). All action uses: lines were already SHA-pinned; no
unpinned @vtag references remain.

https://claude.ai/code/session_01W9Voe3JceP66Bna9FT4jME

Author: claude

.github/workflows/build-validation.yml

@@ -14,6 +14,7 @@ jobs:
   validate-rust:
     name: Rust build validation
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
@@ -23,6 +24,7 @@ jobs:
   validate-elixir:
     name: Elixir build validation
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: elixir-orchestration

.github/workflows/cflite_batch.yml

@@ -10,6 +10,7 @@ permissions: read-all
 jobs:
   batch-fuzzing:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:

.github/workflows/cflite_pr.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   pr-fuzzing:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:

.github/workflows/codeql.yml

@@ -23,6 +23,7 @@ permissions: read-all
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
       security-events: write

.github/workflows/coq-build.yml

@@ -29,6 +29,7 @@ jobs:
   build:
     name: Compile Coq proofs + assumptions guard
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/dogfood-gate.yml

@@ -22,6 +22,7 @@ jobs:
   a2ml-validate:
     name: Validate A2ML manifests
     runs-on: ubuntu-latest
+    timeout-minutes: 60
 
     steps:
       - name: Checkout repository

.github/workflows/elixir-ci.yml

@@ -29,6 +29,7 @@ jobs:
   build-test:
     name: compile + test
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: elixir-orchestration
@@ -62,6 +63,7 @@ jobs:
     # coveralls.json, so they don't dilute the unit-coverage denominator.
     name: ExCoveralls (unit, gate in coveralls.json)
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: elixir-orchestration
@@ -89,6 +91,7 @@ jobs:
   bench-compile:
     name: benchee scripts compile
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: elixir-orchestration
@@ -115,6 +118,7 @@ jobs:
   audit:
     name: hex audit
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: elixir-orchestration

.github/workflows/fuzz.yml

@@ -22,6 +22,7 @@ jobs:
   fuzz-core:
     name: Core Fuzz Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
     steps:
@@ -37,6 +38,7 @@ jobs:
   fuzz-debugger:
     name: Debugger Fuzz Tests
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     permissions:
       contents: read
     steps:

.github/workflows/instant-sync.yml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Trigger Propagation
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3

.github/workflows/reuse.yml

@@ -19,6 +19,7 @@ jobs:
   reuse-lint:
     name: reuse lint
     runs-on: ubuntu-latest
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3