[Azganoth]

Summary

Validate every workflow with pinned actionlint and ShellCheck before starting application checks, and include that result in the required CI Gate. Bound frontend/backend checks and the Windows release build with explicit job timeouts so stalled runs cannot consume the default six-hour allowance.

Related Issue

Not applicable.

Verification

• actionlint 1.7.12 with ShellCheck 0.11.0 passed on all workflow files.
• An external Node validation harness checked gate outcomes for success, failure, cancellation, and skips, rejected an invalid workflow fixture, and confirmed that the existing application/release behavior is preserved apart from dependencies and timeouts.
• pnpm exec oxfmt --check .github/workflows/ci.yml .github/workflows/release.yml CONTRIBUTING.md passed.
• Hosted CI passed workflow linting, frontend/backend checks, desktop E2E, and CI Gate.

Not verified: no release tag was created to exercise the release timeout.

Notes

The 45-minute release budget leaves headroom over recent successful releases, which completed in roughly 20–22 minutes.