Add timeouts to every job and pin actions/checkout to an exact tag

Findings of QC-WF-001 (criteria 8 and 14) applied to the workflows of this
repository and to the two scoped workflows:

- timeout-minutes on every job: quality-checks 15, release 15,
  validate-workflows 10, sync-milestones 15, publish-wiki 10,
  sync-github-metadata 5.
- actions/checkout@v4 becomes actions/checkout@v4.2.2.

No change to inputs, secrets or behaviour. The 6-line run blocks of
sync-milestones.yml move to a script in the framework in a separate change.

CHANGELOG.md

@@ -20,6 +20,13 @@ Each release lists its changes in these groups, in this order:
 
 ## [Unreleased]
 
+### Changed
+
+- Every job has a `timeout-minutes` (5 to 15), so a hung step no longer holds a
+  runner for the host's default limit.
+- `actions/checkout` is referenced by the exact tag `v4.2.2` instead of the
+  moving tag `v4`. No change for callers.
+
 ## [1.1.0] - 2026-10-11
 
 ### Added