fix(ci): time-box every job; stop render-all warning on non-plist templates

The stall. A `bun test --coverage --isolate` step wedged on ubuntu-latest
for over an hour (macOS passed the same commit in 1m30s). ci.yml had no
`timeout-minutes` on either job, so it ran toward GitHub's 6-hour default
while holding the `ci-refs/heads/main` concurrency group — three later
pushes queued behind it and main silently stopped being tested. The wedge
did not reproduce: the identical suite passed in 1m15s on ubuntu once the
group drained, so it was a one-off, not a code defect.

The missing timeout is the actual bug, because it converts any one-off hang
into a branch-wide outage. Every job in every workflow is now time-boxed:
ci quality=15, ci test=20 (normal run ~1 min), scorecard=15. codeql=30 and
snapshot=240/15 already were.

Also documents why CodeQL analyses JS/TS only. The matrix used to carry a
`swift` leg; Swift is compiled for CodeQL, the only Swift on main is the
RFC-0001 experiment package, and building it exceeded the 1-hour cap and
was cancelled (run 30183479244) — failing the workflow on every push while
analysing nothing that ships. The Swift this project actually runs is
template strings in swift-templates.js, which CodeQL cannot read as source
anyway. The old comment invited someone to re-add that leg.

And render-all warned "unknown launchd template" for every non-plist file
under launchd/ — it special-cased the sudoers name, so the new newsyslog
config tripped it on every render. Only *.plist.tpl needs a label mapping
(an unmapped one would land at the wrong filename); everything else is
named literally and just drops .tpl. Gating on the suffix removes the need
for a hardcoded exception per file.