ci: bound CI jobs with timeout-minutes

Add a per-job timeout so a wedged build fails in minutes instead of
hanging until the runner's 3h cap. 30 min on the nix flake check job
(well above a cold-cache rebuild, well under the hard cap) and 5 min
on the seconds-long tracker-tag lint. Complements the runner-level
self-heal (a watchdog that restarts a deadlocked runner): the job
timeout catches a hung job, the watchdog catches a wedged runner.

.forgejo/workflows/ci.yml

@@ -8,6 +8,12 @@ jobs:
   check:
     name: nix flake check
     runs-on: [hive-ci]
+    # Bound the job so a wedged build fails in minutes instead of
+    # hanging until the runner's 3h cap (or, when the runner itself
+    # deadlocks, never). 30 min is well above a cold-cache rebuild
+    # (~15 min observed) and well under the 3h hard cap — tune if a
+    # legit cold build ever trips it.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v3
       - name: check
@@ -19,6 +25,8 @@ jobs:
   tracker-tags:
     name: tracker-tag lint
     runs-on: [hive-ci]
+    # Pure git+grep — seconds normally; a few minutes is already a hang.
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@v3
       - name: lint