ci: add missing timeout-minutes on contract-gate report and Binding RC jobs

[DecisionNerd]

Summary

Several jobs lack timeout-minutes: report in m20-contract-gate.yml and m21-contract-gate.yml, plus validate_source and aggregate in binding-release-candidate.yml. Other jobs in those workflows already set timeouts.

Acceptance criteria

• m20-contract-gate.yml report job has timeout-minutes: 10
• m21-contract-gate.yml report job has timeout-minutes: 10
• Binding RC validate_source has timeout-minutes: 15
• Binding RC aggregate has timeout-minutes: 20
• Binding RC contract tests still pass

Non-goals

• Changing other job timeouts
• Sticky-disk / Bazel native changes

Source

Devinfra Audit Recheck Wave E / PR-D

Validation

• python3 scripts/ci/test-binding-release-candidate.py

[coderabbitai]

🔗 Related PRs

#206 - ci: move job transfers to Blacksmith storage [merged]
#208 - ci: minimize Blacksmith cache storage [merged]
#278 - fix(ci): retain certification evidence as artifacts [merged]
#316 - fix(release): retain Binding RC evidence without brace globs [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!