ci: bound every CI job with timeout-minutes (main)

[rubenvdlinde]

What

Adds timeout-minutes to all 7 CI jobs on main. The companion PR bounded development; main carries the same 7 workflow files and they were all still unbounded.

main is not a dead branch — release-workflow.yaml and build-exapp.yaml have run from it as recently as 2026-08-03, and these are the copies that actually perform releases. A hang there burns a runner for GitHub's 6-hour default before the run fails.

Values — measured, not guessed

Sized from observed fleet-wide durations across the ExApp sidecar wrappers (successful + failed executions; skipped runs excluded).

File	Job	Set	Observed
pull-request-lint-check.yaml	lint-check	15	n=176, median 0.6 min, max 1.4 min
pull-request-from-branch-check.yaml	check-branch	10	n=123, max 0.1 min
push-development-to-beta.yaml	create-pr	20	n=152, max 5.6 min
beta-release.yaml	release-management	45	n=26, max 0.7 min
unstable-release.yaml	release-management	45	n=26, max 0.7 min
release-workflow.yaml	release-management	45	n=26, max 0.7 min
build-exapp.yaml	build	30	no observed runs (docker build)

Release jobs are bounded at 45 rather than near their observed max because a spurious release failure is expensive.

Bounds are deliberately loose. A timeout that fires under normal runner contention is worse than no timeout at all: it converts a slow run into a phantom defect someone then has to investigate.

Verification

• File set and job names were re-derived from main directly rather than assumed to match development — same 7 files, same job names, all previously unbounded.
• Each touched file re-parsed with yaml.safe_load; job set byte-for-byte unchanged from main.
• Each job asserted to carry exactly the value above (positive control); the same probe against the main baseline still reports None (negative control), so it distinguishes bounded from unbounded rather than emitting a constant.
• 7 of 7 jobs bounded. Diff is workflow files only, additions only (2 added lines per file, 0 removed).
• Edits made with an editor, not a scripted rewrite.

Note on the lint-check check on this PR

lint-check is expected to fail here, and the failure is pre-existing and unrelated to this diff.

main's copy of pull-request-lint-check.yaml is an older revision that runs npm i unconditionally. development has since gained a package.json guard that skips the step when the file is absent, but that fix has not reached main. None of these repos has a root package.json, so npm i fails on main regardless of this change.

This PR adds only timeout-minutes lines and touches no step. Porting the guard to main is deliberately left out of scope here to keep this diff additions-only; it is worth a separate PR.