ci(workflows): add timeout-minutes to every job + fix changelog YAML

[hyperpolymath]

Workflow-hygiene hardening

Follow-up to the Hypatia workflow_audit findings that kept surfacing on #358, handled as a separate PR per owner request (keeps #358 focused on the A2ML/K9 foundational layer).

What changed

1. timeout-minutes on every job that lacked one (37 step-jobs, 21 files)
Matches the existing repo convention (governance-reusable.yml: "every job carries timeout-minutes so a transient hang fails fast"):

• 10 min — policy / lint / dispatch / summary jobs (doc-format, makefile-blocker, no-js-scan, licence-consistency, instant-sync, lockstep, scorecard-enforcer checks, trust-summary, fast secret greps).
• 20 min — build / compile / analyze / network / security-scan jobs (affinescript, casket-pages, codeql, deno-ci, elixir, rust-ci ×4, mirror ×7, hypatia-scan, gitleaks/trufflehog, scorecard analysis, spark-theatre-gate).

Reusable-workflow caller jobs (governance.yml, mirror.yml, scorecard.yml, secret-scanner.yml) are intentionally left without timeout-minutes — it is invalid on a job that delegates via uses:; their timeouts live in the called reusable workflows (which this PR fixes).

2. changelog-reusable.yml — fixed unparseable YAML (root bug found during the sweep)
The commit-message body (commit-back mode) and PR body (pr-back mode) had continuation lines at column 0, which terminated the run: | block scalar and left the whole file as invalid YAML — GitHub could not load the workflow at all. Indented the continuations back into the block; the file now parses and its generate job gained a timeout too.

Notes

• unpinned_action findings are false positives. Every uses: in the tree is already pinned to a full 40-char SHA (e.g. actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2). Hypatia truncates the SHA to @de0f in its own message and mis-flags it — that's a rule bug in the hypatia repo, not a repo problem here. No change needed.
• boj-build.yml deliberately untouched. It has a separate pre-existing YAML bug — two orphaned steps (K9-SVC Validation, Contractile Check) indented at job level instead of step level, making the file invalid. The fix is ambiguous (the steps can't simply join trigger-boj, which is gated on if: BOJ_SERVER_URL configured), so it's raised with the owner separately rather than guessed at here.

Validation

• All 27 touched/other workflows parse cleanly (boj-build.yml excepted, by design).
• Zero step-jobs remain without a timeout-minutes.

🤖 Draft.

https://claude.ai/code/session_01XZhw6Fq27eoeyEB4LR3a2c

---

Generated by Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 185 issues detected

Severity	Count
🔴 Critical	64
🟠 High	62
🟡 Medium	59

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror-reusable.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror-reusable.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in mirror-reusable.yml",
    "type": "secret_action_without_presence_gate",
    "file": "mirror-reusable.yml",
    "action": "webfactory/ssh-agent",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence