fix(ci): add job timeout-minutes + fix indexer/analysis boundary violation

Two CI issues investigated on main:

- all-languages job ran for ~6h until GitHub's default job timeout
  auto-cancelled it (started 08:05, cancelled 14:05:51) — no job in
  ci.yml had timeout-minutes set, so a hung test could silently eat
  a runner for the full 6h default instead of failing fast. Added a
  bounded timeout-minutes to every job.

- fitness-check failed on a new architecture boundary violation:
  indexer/refresh.rs importing analysis::coverage::COVERAGE_SEARCH_PATHS
  (introduced by 68d268f's watcher supervision work), inverting the
  indexer-must-stay-upstream-of-analysis rule. Moved the constant to
  a new indexer::coverage_paths module and re-exported it from
  analysis::coverage so existing call sites are unaffected.

Verified locally: cargo build clean, calm fitness-check now PASSes
(boundary violations 0/0), and the coverage/refresh test suites pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   verify:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -32,6 +33,7 @@ jobs:
 
   stack-graphs-corpus:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -44,6 +46,7 @@ jobs:
 
   embeddings:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -70,6 +73,7 @@ jobs:
 
   no-stack-graphs-formal:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -110,6 +114,7 @@ jobs:
 
   all-languages:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -158,6 +163,7 @@ jobs:
   # missing `#[serde(default)]`) the very first time this check ran.
   js-client-interop:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -200,6 +206,7 @@ jobs:
   # an unrelated crate whose name happens to contain the same substring.
   otel-http-features:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
@@ -244,6 +251,7 @@ jobs:
   # own `.calm/index.db`, which a fresh checkout doesn't have yet.
   fitness-check:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 

crates/calm-core/src/analysis/coverage.rs

@@ -23,16 +23,12 @@ impl CoverageData {
     }
 }
 
-pub const COVERAGE_SEARCH_PATHS: &[(&str, &str)] = &[
-    ("lcov.info", "lcov"),
-    ("coverage/lcov.info", "lcov"),
-    (".nyc_output/lcov.info", "lcov"),
-    (".coverage", "python"),
-    ("coverage.out", "go"),
-    ("coverage/coverage.out", "go"),
-    ("coverage.xml", "cobertura"),
-    ("coverage/coverage.xml", "cobertura"),
-];
+// Defined in `indexer::coverage_paths`, not here: `indexer::refresh` also
+// needs this plain path list (to classify coverage files during a
+// watch-triggered refresh), and `indexer` must stay upstream of `analysis`
+// per the fitness-check boundary rule -- re-exported here so existing
+// `analysis::coverage::COVERAGE_SEARCH_PATHS` call sites are unaffected.
+pub use crate::indexer::coverage_paths::COVERAGE_SEARCH_PATHS;
 
 pub fn load_coverage(project_root: &Path) -> CoverageData {
     for &(relative, fmt) in COVERAGE_SEARCH_PATHS {

crates/calm-core/src/indexer/coverage_paths.rs

@@ -0,0 +1,20 @@
+//! Coverage-report search paths — lives in `indexer` (not `analysis`) even
+//! though `analysis::coverage::load_coverage` is the only real consumer of
+//! the parsing logic, because `indexer::refresh` also needs the plain path
+//! list to classify coverage files during a watch-triggered refresh
+//! (`RefreshClassifier::coverage_paths`). `indexer` must stay upstream of
+//! `analysis` (fitness-check's `[[boundaries]]` rule in `thresholds.toml`
+//! enforces this), so the list is defined here and `analysis::coverage`
+//! re-exports it — see the 2026-07-28 `hotspot_risk`/`common.rs` split for
+//! the same pattern applied to a different boundary violation.
+
+pub const COVERAGE_SEARCH_PATHS: &[(&str, &str)] = &[
+    ("lcov.info", "lcov"),
+    ("coverage/lcov.info", "lcov"),
+    (".nyc_output/lcov.info", "lcov"),
+    (".coverage", "python"),
+    ("coverage.out", "go"),
+    ("coverage/coverage.out", "go"),
+    ("coverage.xml", "cobertura"),
+    ("coverage/coverage.xml", "cobertura"),
+];

crates/calm-core/src/indexer/mod.rs

@@ -1,4 +1,5 @@
 pub mod chunker;
+pub mod coverage_paths;
 pub mod crate_map;
 pub mod csharp_namespace;
 pub mod edges;

crates/calm-core/src/indexer/refresh.rs

@@ -8,7 +8,7 @@
 use std::collections::{BTreeSet, VecDeque};
 use std::path::{Component, Path, PathBuf};
 
-use crate::analysis::coverage::COVERAGE_SEARCH_PATHS;
+use crate::indexer::coverage_paths::COVERAGE_SEARCH_PATHS;
 use crate::indexer::lang_constants::{is_recognized_unparsed_extension, language_for_extension};
 use crate::walk::{build_walker, is_ignored_dir_component, matches_ignore_pattern};