CI: raise the validate and validate-macos timeouts for the #381 tooling tests - #512

Scope

• What this PR changes, in one or two sentences: raises the job timeouts of validate (.github/workflows/validate.yml, 20 to 40 minutes) and validate-macos (.github/workflows/adoption-bootstrap.yml, 30 to 60 minutes) because the measurement tooling still to merge for the PR-H: E2E preregistration for the token-save-practice stack (frozen tasks, metrics, gate, procedure) #381 token E2E adds unit-test time that would pass the old limits; the limits stay hang guards.
• Base commit: df412368
• Lane: lane:foundation (the growth is foundation tooling tests; no trading-lane path or workflow behaviour changes)
• Owned paths touched: .github/workflows/validate.yml, .github/workflows/adoption-bootstrap.yml, manifests/evidence.json (hot file, last commit)

SOTA sources

• GitHub Actions workflow syntax, jobs.<job_id>.timeout-minutes (https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes): the maximum minutes a job may run before GitHub cancels it; default 360.
• This repository's own precedent: the comment block above validate's timeout-minutes records the 2026-09-26 raise from 10 to 20 minutes with the measured runs that exceeded the limit; this change follows the same rule and adds its own measurements.

Evidence-class table

Local commands run

$ python3 -B -m unittest tests.test_workflow_hardening tests.test_workflow_security_coverage
Ran 84 tests / OK (skipped=2)
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 8101, "profiles": 4, "receipts": 171, "status": "passed"}

Decision record

None new; the reasoning is in the comment blocks of the two workflow files. Overturn: if a later change shards the suite into parallel jobs, these limits can drop again.

Host evidence

Not applicable (no files under evidence/hosts/).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment (no action changes).
• New/changed workflows declare top-level permissions: contents: read (unchanged).
• No secrets are printed, logged or committed.
• No new paid hosting, subscription or billing surface was introduced (longer hang guards only; runner minutes follow actual test time).
• Peer-owned untracked files and worktrees were preserved.

🤖 Generated with Claude Code