IronClaw's #7756 swept every unbounded CI operation (apt hangs, uncapped jobs, external downloads). Same sweep here found exactly one gap: the osv-scanner emit-status wrapper job had no timeout-minutes, so a wedged artifact download could hold a runner for GitHub's 6-hour default. Every other job across all 30 workflows is already bounded. Capped at 10m.