CI time limit on the step; no timeout in Dockerfile or scripts (closes #199)

The runner ignores a job's timeout-minutes, so the 20-minute limit moves
to the step that runs script/cibuild. The Dockerfile frontend-test stage,
script/frontend-test and script/frontend-viewport-test drop their timeout
wrappers, which failed make check on a busy host. go test's -timeout 90s
stays, as REPO_POLICIES.md requires it.

Model: opus-5-5

TODO.md

@@ -26,8 +26,7 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 - 2026-11-10: the CI time limit of 20 minutes is on the step that runs
   `script/cibuild` ([#199](https://git.eeqj.de/sneak/netwatch/issues/199)). The
   runner ignored it on the job. The `Dockerfile`, `script/frontend-test` and
-  `script/frontend-viewport-test` no longer wrap commands in `timeout`, so
+  `script/frontend-viewport-test` no longer wrap commands in `timeout`.
-  `make check` has no time limit outside CI.
 - 2026-10-26: `README.md`, `TODO.md` and `test/viewport/README.md` are rewritten
   sentence by sentence ([#189](https://git.eeqj.de/sneak/netwatch/issues/189)).
   Each sentence reads on the first pass: one idea, under about 30 words, the

script/frontend-viewport-test

@@ -31,8 +31,8 @@ HARNESS="netwatch-viewport-harness-$RUN_ID"
 ARTIFACT_DIR="$ROOT/tmp/viewport"
 
 # Every container is named and removed here, including the harness itself:
-# an interrupted `docker run` client does not remove the container it
+# a `docker run` client that is killed outright leaves its container
-# started, and an unnamed survivor keeps the --internal network in use so
+# running, and an unnamed survivor keeps the --internal network in use so
 # `docker network rm` fails too. This host runs many sessions at once and
 # neither may be left behind.
 cleanup() {