CI time limit on the step; no timeout in Dockerfile or scripts (closes #199)

The runner ignores a job's `timeout-minutes`, so the 20-minute limit moves to the step that runs `script/cibuild`. The `Dockerfile`, `script/frontend-test` and `script/frontend-viewport-test` drop their `timeout` wrappers, which also stopped `make check` outside CI. `go test -timeout 90s` stays, as `REPO_POLICIES.md` requires it.

Deviation: `REPO_POLICIES.md`, vendored from `sneak/prompts`, still says the job sets the limit.

Model: opus-5-5

TODO.md

@@ -23,6 +23,10 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-11-10: the CI time limit of 20 minutes is on the step that runs
+  `script/cibuild` ([#199](https://git.eeqj.de/sneak/netwatch/issues/199)). The
+  runner ignored it on the job. The `Dockerfile`, `script/frontend-test` and
+  `script/frontend-viewport-test` no longer wrap commands in `timeout`.
 - 2026-10-26: `README.md`, `TODO.md` and `test/viewport/README.md` are rewritten
   sentence by sentence ([#189](https://git.eeqj.de/sneak/netwatch/issues/189)).
   Each sentence reads on the first pass: one idea, under about 30 words, the