feat(ci): expose the runner job timeout as a tunable option

The runner hardcoded a 3h per-job timeout. Surface it as
services.hyperhive.forge.ci.jobTimeout so a stuck or runaway job is
bounded by a sane default while staying overridable for operators who
legitimately run longer jobs.

Default drops to 1h (comfortably covers a cold-cache nix build while
bounding a hang far sooner than the old 3h); raise it via the option
for genuinely long jobs. Accepts a Go duration string.

Resolves the stuck-runner concern from the CI-outage follow-up with a
runner-enforced job timeout rather than an external watchdog, per
operator direction.

nix/modules/hive-ci.nix

@@ -231,6 +231,23 @@ in
       defaultText = lib.literalExpression "pkgs.gitea-actions-runner";
       description = "gitea-actions-runner package.";
     };
+
+    jobTimeout = lib.mkOption {
+      type = lib.types.str;
+      default = "1h";
+      example = "3h";
+      description = ''
+        Per-job wall-clock timeout the runner enforces (act_runner's
+        `runner.timeout`). A job that exceeds it is killed, so a hung or
+        runaway build is bounded instead of holding the runner's single
+        slot indefinitely. Default `1h` comfortably covers a cold-cache
+        nix build while still bounding a stuck job; raise it (e.g.
+        `"3h"`) if you legitimately run jobs longer than that. Accepts a
+        Go duration string (`30m`, `1h`, `2h30m`). Note: this is
+        enforced by the runner process, so it only fires while that
+        process is itself healthy.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -343,8 +360,8 @@ in
             labels = cfg.labels;
             settings = {
               runner.capacity = cfg.concurrency;
-              # Generous timeout for cold-cache nix builds.
+              # Per-job wall-clock cap — see the `jobTimeout` option.
-              runner.timeout = "3h";
+              runner.timeout = cfg.jobTimeout;
             };
           };