ci: require workflow timeouts and permissions

[AlexStocks]

Summary

• add explicit timeouts to every ordinary job that lacked one in the main, E2E harness, documentation deploy, and release workflows
• add the missing workflow-level least-privilege contents: read permission to the license check
• extend the governance checker to reject ordinary workflow jobs with no positive timeout or no workflow/job-level permissions
• validate that the reusable-workflow exception has a nonblank uses reference and only GitHub-supported caller-job keywords
• add focused regression cases for missing timeout, missing permissions, and malformed reusable-workflow callers

Rationale

WP0-B in #3 requires explicit job bounds and least-privilege permissions. Reusable-workflow caller jobs are intentionally excluded from the timeout rule because GitHub Actions does not allow timeout-minutes on jobs that use a reusable workflow; their called workflows define the executable job bounds.

The caller exception now rejects blank references, timeout-minutes, and ordinary-only fields such as runs-on or steps, so adding a uses key cannot bypass the ordinary-job timeout contract.

This PR is stacked on #29 (codex/wp0-governance-contract).

Behavior, API, and compatibility

• no application, public API, dependency, or generated-contract changes
• preserves all job names and commands
• only bounds existing CI execution and makes existing permission and caller-job policy machine checked

Validation

• regression proof: the malformed-caller cases failed against 1acb4a38248ae74c9dad6bf3625d4618bd27e844 and pass after the fix
• go test ./tools/governance-check -count=1
• go test -race ./tools/governance-check -count=1
• go vet ./tools/governance-check
• make governance-check
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• LF checkout: go mod tidy -diff, go mod verify, and golangci format verification passed
• merged current Base 764ac0426cd568c789f8d7bd7cf669c2efe4b371; the combined Issue Form and workflow governance tests pass
• git diff --check
• exact-Head GitHub Actions: 27/27 checks succeeded, including Analyze Go and CodeQL
• Main run 33230722738: the failed-only rerun passed after a transient Tsinghua PyPI mirror 403; the exact Head did not change

Exact head validated: a6dfab415b236e2b2fb6c1a2615837a338dca493.

AI usage

Implemented with Codex assistance. The exact submitted workflow and validator changes were self-reviewed and checked with the commands above.