fix(ci): stop the Node 24.21 healthcheck hang and cap job runtimes (#267)

## Summary

The **Node 24** CI job hangs on every PR until GitHub's 6-hour limit.
`node-version: "24"` now resolves to **v24.21.0**, whose `node:http2`
client defers `RST_STREAM` while receiving (nodejs/node#65093, a
v24-only adaptation of #64166). A stream closed with `req.close()` from
its `'response'` handler before its body is read is never destroyed, so
the client keeps its TCP connection open. The healthcheck test helper
`httpStatus` uses exactly that pattern. As a result, the server's
graceful `stop()` never completes and the integration suite never exits.

The regression was reproduced on plain `node:http2` without Connectum:
24.20.0 exits, 24.21.0 hangs, 26.10.0 exits. It is a client-side issue;
the server's Node version is irrelevant.

- **Test.** `worker-components.test.ts` `httpStatus` drains the response
body before closing the session.
- **CI.** Every workflow job gets `timeout-minutes`: 15, and 30 for
"Release & Publish". The slowest job over 224 successful runs took 116
s, so a hang now fails in minutes instead of hours.

A related server-side reliability gap is **not** addressed here and will
get its own PR: after `shutdown.timeout`, Connectum destroys HTTP/2
sessions but not raw sockets, so the process does not exit while a
client holds TCP.

## Type of change

- [ ] Bug fix (non-breaking)
- [ ] New feature (non-breaking)
- [ ] Breaking change (documented in migration guide)
- [x] Documentation / chore / internal

## Test plan

- [x] healthcheck integration suite in Docker: 16/16 with exit in about
1 s on `node:24.20.0`, `node:24.21.0` and `node:26.10.0`. Before the
fix, 24.21.0 hung.
- [x] `pnpm build && pnpm typecheck && pnpm test` pass locally (33/33
turbo tasks)
- [x] `pnpm lint` passes locally. The only warning,
`packages/events/src/broadcast.ts:18`, pre-exists on `main`.
- [x] `pnpm release:contract` passes (`release.yml` gains only
`timeout-minutes`)
- [x] Every job has `timeout-minutes`, checked with `yq` over all 10
workflow files.
- [ ] CI "Node 24" green on this PR is the end-to-end check.

## Parity coverage

- [ ] Parity coverage added
- [x] Parity N/A: test helper and CI configuration only, no RPC
behaviour changes.

## Related issues / changes

- Upstream: nodejs/node#65093 / #64166 (v24.21.0).
- Unblocks the Node 24 job on #265 and future PRs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Automated checks and maintenance workflows now have a 15-minute time
limit, and release publishing has a 30-minute limit.
* Health-check integration tests now wait for HTTP/2 responses to finish
before reporting the status.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: intech

.github/workflows/auto-assign.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       issues: write
       pull-requests: write

.github/workflows/auto-label.yml

@@ -16,6 +16,7 @@ jobs:
     name: Label Pull Request
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -85,6 +86,7 @@ jobs:
     name: Label Issue
     if: github.event_name == 'issues'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Apply triage and detect type
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/bsr-publish.yml

@@ -26,6 +26,7 @@ jobs:
   publish:
     name: Publish to Buf Schema Registry
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/buf.yml

@@ -18,6 +18,7 @@ jobs:
   lint:
     name: Lint & Breaking
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       matrix:
         package: [auth, events]

.github/workflows/ci.yml

@@ -13,11 +13,15 @@ concurrency:
 permissions:
   contents: read
 
+# Every job caps its runtime with timeout-minutes. Jobs finish in about two
+# minutes; without a cap a hung test (e.g. an HTTP/2 connection that never
+# closes) holds the runner for GitHub's 6-hour default before failing.
 jobs:
   # ── Lint, Typecheck, Audit (run once on dev Node) ──────────────────────
   quality:
     name: Typecheck, Lint & Test
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -50,6 +54,7 @@ jobs:
   test-node:
     name: "Node ${{ matrix.node-version }}"
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -83,6 +88,7 @@ jobs:
   test-amqp-broker:
     name: AMQP broker integration
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     services:
       rabbitmq:
         image: rabbitmq:4-alpine
@@ -117,6 +123,7 @@ jobs:
   test-redis-broker:
     name: "Redis protocol (${{ matrix.broker.name }})"
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -157,6 +164,7 @@ jobs:
   test-amqp-recovery:
     name: AMQP recovery (testcontainers)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     continue-on-error: true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -191,6 +199,7 @@ jobs:
   test-bun:
     name: Bun (${{ matrix.bun }})
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -228,6 +237,7 @@ jobs:
   test-esbuild:
     name: esbuild transpilation
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/cli-scaffold-matrix.yml

@@ -37,6 +37,7 @@ jobs:
   discover:
     name: discover combinations
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     outputs:
       combos: ${{ steps.list.outputs.combos }}
     steps:
@@ -54,6 +55,7 @@ jobs:
     name: "init ${{ matrix.combo.name }}"
     needs: discover
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:

.github/workflows/create-release.yml

@@ -15,6 +15,7 @@ jobs:
   release:
     name: Create Release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/parity-gate.yml

@@ -27,6 +27,7 @@ jobs:
   parity:
     name: HTTP ↔ in-process parity
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/release.yml

@@ -17,6 +17,8 @@ jobs:
   release:
     name: Release & Publish
     runs-on: ubuntu-latest
+    # Longer than the CI jobs: a release run publishes 15 packages to npm.
+    timeout-minutes: 30
     steps:
       - name: Generate App token
         id: app-token

.github/workflows/snapshot.yml

@@ -16,6 +16,7 @@ jobs:
   snapshot:
     name: Publish PR Snapshot
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
@@ -37,6 +38,7 @@ jobs:
     name: "Release Gate (Node ${{ matrix.node-version }})"
     needs: snapshot
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix: