fix(ci): drop invalid timeout-minutes from 4 reusable-workflow calls (were parse-rejected/dead)

[hyperpolymath]

What

governance.yml, hypatia-scan.yml, mirror.yml, and secret-scanner.yml each set a job-level timeout-minutes: on a job that calls a reusable workflow via uses:. GitHub does not permit that key on a workflow_call job, so it rejected all four files at parse time — they failed instantly (0s, run titled by raw filename) on every push and never executed a single job.

Net effect on the hub: governance enforcement, hypatia scanning, GitLab mirroring, and secret scanning were all silently disabled.

Evidence

• gh run view on a recent run: "This run likely failed because of a workflow file issue."
• actionlint (real tool): when a reusable workflow is called with "uses", "timeout-minutes" is not available on all four.

Fix

Remove the invalid caller-side timeout-minutes:. The standards *-reusable.yml workflows already declare timeout-minutes on every internal job, so the caller key was redundant as well as invalid. This matches the already-correct rsr-template-repo pattern, and the upstream hypatia rule missing_timeout_minutes (lib/rules/workflow_audit.ex) already exempts reusable-call jobs — so these will not be re-flagged.

Verification

actionlint on the four files: exit 0, zero timeout-minutes is not available findings remain on the hub.

Wider context

This is the reference fix for an estate-wide shared-fate defect: 84 repos carry the same dead pattern. A scripted, verified sweep of the remaining 83 is proposed separately.

🤖 Generated with Claude Code