feat(gate): stop a gate after 30 minutes by default, and take --timeout in minutes

[protonspy]

What changed

• The bound on one gate run (build, format, lint, test) moves from 10 to 30 minutes: gate.Timeout becomes gate.DefaultTimeout = 30 * time.Minute.
• scc check and scc validate accept --timeout <minutes> to move the bound for one run. On validate it implies --checks, since a bound with no gates to apply to would be silently ignored.
• The value lives on gate.Config.Timeout (json:"-"), so it is never written to the manifest; Config.Limit() falls back to the default for zero.
• A check.timed-out finding now names the limit the gate was held to (Result.Limit), since it is no longer a constant.
• --timeout of 0, a negative, a non-number, or a value too large to fit a time.Duration is a usage error (exit 1).

Plan: plans/gate-timeout-30m.md

How it was verified

• New tests: TestLimitDefaults, TestRunStopsAtTheLimit (gate); timed-out finding names the limit (validate); TestCheckTimeoutTakesPositiveMinutes, TestValidateTimeoutRunsTheGates (cli).
• scc validate --checks exits 0: build, format, lint, and test gates pass (1009 tests, 86.2% coverage).

Reviews

• scc-code-review: clean. No findings. Scoped tests and lint re-run green.
• scc-security-review: clean. Two low findings:
  • --timeout overflow when multiplied into a time.Duration: fixed in the second commit, which rejects values above MaxInt64/time.Minute.
  • A hanging gate can now stall a pre-push for up to 30 minutes per gate: not changing. That is the requested trade-off, and --timeout lowers the bound for a run.