jules-review.yml lacks the fork guard and job timeout ai-config's copy has

[d-morrison]

Symptom

.github/workflows/jules-review.yml runs the Jules action with no fork guard and no timeout-minutes. ai-config's copy of the same workflow, at the same pinned SHA, has both.

Why the fork guard matters

The action reads jules_api_key with required: true before its own skip_forks check. Checked against the pinned SHA (fc66a7c):

• action.yml declares jules_api_key as required: true.
• skip_forks defaults to 'true', but the key is read first.

A fork PR gets no access to secrets.JULES_API_KEY, so the input is empty and the action hard-fails rather than skipping gracefully. The result is a red jules/review on every fork PR, for a review that was never going to run.

ai-config's copy guards it at the job level:

if: github.event.pull_request.head.repo.full_name == github.repository

Why the timeout matters

The action's own timeout_minutes defaults to 30, and it uses that budget to give up gracefully and still post a verdict. With no job-level timeout-minutes, a hung run rides the runner default (360 minutes) instead of being bounded just above the action's own budget. ai-config sets timeout-minutes: 40, leaving the action 10 minutes to report before the runner hard-kills the job -- which would otherwise leave jules/review stuck pending with no comment.

Note the two have to be raised together, never the job timeout alone.

Suggested fix

Port both from ai-config's copy, along with the comments explaining why each number is what it is.

Provenance

Noticed while implementing #366 in #371, which touched this file for an unrelated reason. Out of scope there, so filed rather than folded in.