IronClaw's #7756 swept every unbounded CI operation (apt hangs, uncapped
jobs, external downloads). Same sweep here found exactly one gap: the
osv-scanner emit-status wrapper job had no timeout-minutes, so a wedged
artifact download could hold a runner for GitHub's 6-hour default. Every
other job across all 30 workflows is already bounded. Capped at 10m.