ci: add per-job timeout-minutes to every workflow job

[AminDhouib]

No job in this repository declared timeout-minutes, so a wedged step
could hold a runner until the 6 h Actions default. Each job now carries
an explicit ceiling. The rule is 3 x the observed p90 duration rounded
up to the nearest 5 minutes; every job below was unobserved in the 72 h
of run history, so each takes its class default.

.github/workflows/ci.yml
build-and-import 30 class default (build)
e2e-smoke 45 class default (e2e)
lint 15 class default (lint)
models-drift 30 class default (other)
unit-test 45 class default (e2e)

.github/workflows/publish.yml
build-and-publish 30 class default (build)

.github/workflows/spec-drift.yml
spec-drift 30 class default (other)

No concurrency edit was planned for this repository.
ci.yml already declares group: ci-${{ github.ref }}, cancel-in-progress: true.

Part of the CI pool right-sizing programme; edits derived from 72 h of run history.

[AminDhouib]

Leaving this open: e2e-smoke is red for a reason unrelated to this diff. tests/e2e/test_unauthenticated_prod.py compares the live production spec against the checked-in openapi/v1.json, and production now exposes five operations the file does not have: addTaskDependency, listTaskDependencies, removeTaskDependency, listTaskOccurrences, setTaskOccurrenceStatus. openapi/v1.json is untouched by this branch, so main would fail the same assertion; the last CI run on main predates the drift. Fix is the one the assertion names: run scripts/sync-spec.sh and scripts/regenerate-models.sh. This branch only adds timeout-minutes keys.