Merge pull request 'ci: add missing timeout-minutes guards to hot-path jobs' (#122) from ci/timeout-guards-0pt-20260927 into main

.gitea/workflows/cd.yml

@@ -21,6 +21,7 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     env:
       COOLIFY_APP_ID: ${{ vars.COOLIFY_APP_ID || 'TODO-no-coolify-app-provisioned-yet' }}
       IMAGE_REPO: git.cloud.siax.io/sax3l/0pt

.gitea/workflows/ci.yml

@@ -24,6 +24,7 @@ on:
 jobs:
   quality:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -76,6 +77,7 @@ jobs:
     # ordinary branch pushes still run blocking quality/security.
     if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     services:
       opt-ci-opensearch:
         image: opensearchproject/opensearch:2.11.1
@@ -226,6 +228,7 @@ jobs:
   # measurable blind spot into declared policy.
   security:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - name: Install Trivy

.gitea/workflows/masterplan-lock.yml

@@ -15,6 +15,7 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
       - name: Masterplan lock check

.gitea/workflows/release.yml

@@ -73,6 +73,7 @@ jobs:
   release:
     name: Build, push, G17 (SBOM/scan/attest/verify/evidence)
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     steps:
       - uses: https://git.siax.io/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, mirrored + SHA-pinned (SUP-06, same pin n0d/cl0ud/st0re/h0st already use)
         with:

.gitea/workflows/security.yml

@@ -28,6 +28,7 @@ on:
 jobs:
   security:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
       - name: Install Trivy