fix: add workflow-timeouts guard and test coverage for issue #420

[mvillmow]

Summary

Implements issue #420: adds a custom CI guard (scripts/check-workflow-timeouts.sh) that verifies every job in .github/workflows/*.yml declares an explicit timeout-minutes value. The JSON-Schema validator cannot enforce this semantic rule, so this guard fills the gap.

Changes:

1. Prerequisite fixes for existing workflows that were missing timeouts

   • label-sync.yml → sync-labels job: timeout-minutes: 5
   • tech-debt-discovery.yml → discover job: timeout-minutes: 10

2. New guard script (scripts/check-workflow-timeouts.sh)

   • Parses YAML with pyyaml to verify semantic rule
   • Emits GitHub Actions ::error:: annotations for violations
   • Skips reusable-workflow callers (which cannot have timeout-minutes)
   • Uses git ls-files to find workflows (respects .gitignore)

3. Regression tests (tests/test_workflow_timeouts.py)

   • test_every_job_has_timeout_minutes — sanity check on shipped workflows
   • test_script_flags_missing_timeout — negative case, script rejects bad workflows
   • test_script_accepts_clean_workflow — happy path, script passes valid workflows

4. CI integration (added job to _required.yml)

   • New workflow-timeouts job wired after lint (follows established pattern)
   • Runs the guard as a required check in the PR/main pipeline
   • 3-minute timeout (ample for YAML scanning)

5. Dev dependency — Added pyyaml = ">=6.0,<7" to pixi dev environment

Test plan

• All three new regression tests pass (pytest tests/test_workflow_timeouts.py)
• No regression in existing unit test suite (pytest -m "not integration" → 481 passed)
• Script accepts all 5 current workflows (scripts/check-workflow-timeouts.sh → exit 0)
• Lint & pre-commit checks pass (no style issues)
• Workflow YAML validates against GitHub Actions schema
• Negative sanity check: script correctly rejects workflows missing timeout-minutes

Closes #420

Co-Authored-By: Claude Haiku 4.5 noreply@anthropic.com

[mvillmow]

Correct, complete, well-tested guard for #420; all 17 workflow jobs comply. One minor bool-as-int edge case in the script.

[mvillmow]

Guard script + tests + workflow fixes are correct and address prior bool review; but a generated coverage.xml (851 lines, leaks absolute path) was accidentally committed and must be removed.

[mvillmow]

Guard script + tests + workflow timeout fixes are correct and address prior bool review; but a generated coverage.xml (851 lines, leaks absolute path) was committed by accident and must be removed.