Add explicit timeouts to all workflow jobs

[den-sq]

Summary

• add an explicit timeout-minutes value to every GitHub Actions job
• cap Electron release packaging at 45 minutes and the Docker server-image build at 30 minutes
• cap documentation, coverage, publishing, PR resolution, and release tagging jobs at 10–15 minutes

Closes #127

Timeout sizing

Job class	Timeout	Recent healthy runtime
Electron release matrix	45 min	about 1–3 min
Server image	30 min	about 2.5 min
Coverage/docs/publish	15 min	coverage under 1 min
PR resolution/tagging	10 min	PR resolution a few seconds

These values leave substantial headroom for dependency and runner variance while ensuring a stuck build or teardown fails well before GitHub's six-hour default.

Validation

• parsed all seven workflow files as YAML
• asserted all eight workflow jobs have a non-empty timeout-minutes
• git diff --check passed
• Prettier still reports the existing formatting baseline in build-docs.yml, pr-coverage.yml, and python-coverage.yml; the added lines follow those files' current indentation and this PR avoids unrelated full-file reformatting

Shared-basis audit

• Inspected every job in .github/workflows/ and extended the job definitions directly, which are the canonical ownership point for Actions runtime limits.
• No composite action, reusable workflow, wrapper, or second timeout mechanism was introduced.
• Load-bearing decision: job-level limits are sufficient to bound buildx and electron-builder hangs, so this PR does not duplicate those limits at individual steps.
• Load-bearing sizing: 45 minutes for cross-platform packaging, 30 minutes for the server image, 15 minutes for coverage/docs/publish, and 10 minutes for resolve/tag jobs. A timeout fails the whole owning job and therefore also bounds teardown time.

[tavateva]

APPROVE — reviewed at head 43a8e57.

AC sweep (#127):

1. Every workflow job declares an explicit timeout-minutes — verified empirically by parsing all seven workflow files at this head with a YAML loader: 8/8 jobs covered (resolve-pr-build 10, build-packages 45, docs 15, coverage 15, tag 10, publish 15, test-coverage 15, server-image 30). No missed jobs, no eighth workflow file.
2. buildx / electron-builder bounded well under 6h — the two named hang-prone jobs get 30 and 45 minutes respectively. Job-level timeouts bound teardown as well as the build step, which covers the observed autoseg-class hang; the declared judgment that per-step timeouts are unnecessary duplication is reasonable.
3. Healthy margin, no flaky timeouts — cross-checked against this PR's own check runtimes (linux 2m31s, mac 2m3s, win 2m44s, server-image 2m6s, coverage 54s, resolve 4s): margins are 12–45× healthy runtime. Values also match the issue's suggested ranges exactly.

Mechanics: +8/−0, one line per job, each matching its file's existing indentation (no reformatting — the body's prettier note holds). Whitespace check clean. All six CI checks green, MERGEABLE/CLEAN; the edited workflows demonstrably parse since GitHub ran them for this PR.

Undeclared-decision sweep: clean — sizing is declared with a runtime table, and the job-level-vs-step-level choice is declared with grounding.

Verification depth: YAML-parsed every workflow at the PR head and enumerated jobs locally; cross-checked sizing against the live check runtimes; relied on CI for workflow execution.