Governance/Hypatia hygiene: 0-AI-MANIFEST.a2ml, codeql workflow, workflow timeouts

[hyperpolymath]

Pre-existing Hypatia baseline findings (201 total; non-blocking) in boj-server-cartridges. Mechanical cleanup, separate from the TS→AffineScript port (#46).

Items

• 0-AI-MANIFEST.a2ml missing (root_hygiene, high) — create per the hyperpolymath standard (boj-server's 0-AI-MANIFEST.a2ml is a template).
• codeql.yml missing (workflow_audit, high) — add a CodeQL workflow (mirror boj-server's .github/workflows/codeql.yml).
• missing_timeout_minutes — add timeout-minutes to every job lacking it: cartridge-schema.yml, governance.yml, hypatia-scan.yml, mirror.yml, scorecard.yml, secret-scanner.yml, and the heavy zig-test job in zig-test.yml.

Notes

• The banned-TypeScript critical findings are tracked in Port stack-orchestrator-mcp + proof-lsp adapters: TypeScript → AffineScript #46 (the port), not part of this hygiene pass.
• Done-when: a fresh Hypatia scan no longer reports these; actionlint clean on touched workflows.

https://claude.ai/code/session_019tMcRS1Dm1nWjjYP4WvbJa