ci: add timeout-minutes to the 4 reusable-workflow jobs that lacked it

[hyperpolymath]

What

Adds timeout-minutes to the 4 reusable-workflow jobs that lacked it:

Reusable workflow	Job	timeout
hypatia-scan-reusable.yml	scan	20m
scorecard-reusable.yml	scorecard	15m
governance-reusable.yml	workflow-staleness	10m
governance-reusable.yml	validate-hypatia-baseline	15m

mirror-reusable.yml and secret-scanner-reusable.yml already set a timeout on every job — untouched.

Why here (not in the consumer repos)

Hypatia flags missing_timeout_minutes on estate repos' workflow files (e.g. gossamer#77 lists governance, hypatia-scan, scorecard, secret-scanner, spark-theatre-gate). But those consumer workflows are thin uses: callers of these reusable workflows — GitHub Actions does not allow timeout-minutes on a job that calls a reusable workflow. So the timeout has to live here. Fixing it once in standards discharges the hygiene item for every estate consumer at once.

Safety

• Values are generous (won't abort healthy runs); they only cap runaway hangs.
• YAML validated (yaml.safe_load) for all three edited files; each job confirmed to carry its new timeout-minutes.
• +4 lines, no logic changes. Commit signed.

Refs gossamer#77 (workflow-hygiene slice).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud