Set a time limit on the canonical check job (closes #120)

The canonical check workflow gave its job no time limit, so a hung
script/cibuild held the shared runner until the runner's own default.
The check job now sets timeout-minutes: 20. script/cibuild runs three
Docker builds (the test phase, the lint phase, then the image, which
runs both again), each held to the 5-minute build limit, plus the
bootstrap. REPO_POLICIES.md and both checklists name the limit among
what the workflow sets.

Model: opus-5-5

prompts/EXISTING_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: Existing Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-07
 ---
 
 Use this checklist when beginning work in a repo that may not yet conform to our
@@ -102,9 +102,10 @@ with your task.
       build finds the tag too.
 - [ ] Gitea Actions workflow in `.gitea/workflows/` runs `script/cibuild` on
       push, checks out with `persist-credentials: false` and with
-      `fetch-depth: 0` (which fetches the tags `git describe` needs), and
-      carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
+      `fetch-depth: 0` (which fetches the tags `git describe` needs), carries
+      the `concurrency` block that lets a new push cancel only the same branch's
+      older run, and sets `timeout-minutes: 20` on the `check` job so a hung
+      build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific config:
     - [ ] Go: `go.mod`, `go.sum`, `.golangci.yml` (fetch from

prompts/NEW_REPO_CHECKLIST.md

@@ -1,6 +1,6 @@
 ---
 title: New Repo Checklist
-last_modified: 2026-10-06
+last_modified: 2026-10-07
 ---
 
 Use this checklist when creating a new repository from scratch. Follow the steps
@@ -113,9 +113,10 @@ Template files can be fetched from:
     - Image pinned by sha256 hash with version/date comment
 - [ ] Gitea Actions workflow at `.gitea/workflows/check.yml` that runs
       `script/cibuild` on push, checks out with `persist-credentials: false` and
-      with `fetch-depth: 0` (which fetches the tags `git describe` needs), and
+      with `fetch-depth: 0` (which fetches the tags `git describe` needs),
       carries the `concurrency` block that lets a new push cancel only the same
-      branch's older run — reference
+      branch's older run, and sets `timeout-minutes: 20` on the `check` job so a
+      hung build frees the shared runner — reference
       `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml`
 - [ ] Language-specific:
     - [ ] Go: `go mod init sneak.berlin/go/<name>`, `.golangci.yml` (fetch from

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-10-06
+last_modified: 2026-10-07
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -304,12 +304,16 @@ style conventions are in separate documents:
   carry the same guarantee, because its gate phases may come from the cache. The
   image build is uncached and so runs the gate phases a second time. That is the
   price of the rule above, and it is worth paying: the image that ships is built
-  from a run of its own gates rather than from a cache entry. A separate
-  workflow limited to `main` by a `branches` list under `on: push` cannot be
-  checked by review: to try a change to it, add the feature branch to that list
-  and push, then remove the branch from the list again before merging. Keep any
-  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
-  from the feature branch publishes nothing.
+  from a run of its own gates rather than from a cache entry. The `check` job
+  sets `timeout-minutes: 20`, so a hung build frees the shared runner after 20
+  minutes. That allows for the three Docker builds described above (the test
+  phase, the lint phase, then the image), each held to the 5-minute Docker build
+  limit below, plus the bootstrap. A separate workflow limited to `main` by a
+  `branches` list under `on: push` cannot be checked by review: to try a change
+  to it, add the feature branch to that list and push, then remove the branch
+  from the list again before merging. Keep any job in it that publishes behind
+  `if: github.ref_name == 'main'`, so the run from the feature branch publishes
+  nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with