ci: add missing timeout-minutes to cd, maintenance, and sync-labels jobs (#4143)

Prevents runaway builds from blocking runners indefinitely.

- cd.yaml: goreleaser (30m), vscode-extension (15m), mcp-publish (10m), publish-release (5m)
- maintenance.yaml: delete-old-workflow-runs (10m), delete-old-images (10m)
- sync-labels.yaml: sync-labels (5m)

Co-authored-by: ksail-bot[bot] <262010955+ksail-bot[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ksail-bot[bot]

.github/workflows/cd.yaml

@@ -25,6 +25,7 @@ jobs:
   goreleaser:
     name: Release with GoReleaser
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
       packages: write
@@ -85,6 +86,7 @@ jobs:
   vscode-extension:
     name: 🧩 Release VSCode Extension
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     needs: [goreleaser]
     permissions:
       contents: write
@@ -146,6 +148,7 @@ jobs:
   mcp-publish:
     name: 📤 Publish to MCP Registry
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     needs: [goreleaser]
     permissions:
       id-token: write
@@ -281,6 +284,7 @@ jobs:
   publish-release:
     name: 📢 Publish Release
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     needs: [goreleaser, vscode-extension, mcp-publish, pages-deploy]
     permissions:
       contents: write

.github/workflows/maintenance.yaml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   delete-old-workflow-runs:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       actions: write
       contents: read
@@ -35,6 +36,7 @@ jobs:
 
   delete-old-images:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       packages: write
     steps:

.github/workflows/sync-labels.yaml

@@ -14,6 +14,7 @@ permissions:
 jobs:
   sync-labels:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0