ci: move the census timeout validation out of inline YAML into a tested scripts/ gate

[louistrue]

The census lane's run: block now carries roughly 60 lines of shell whose only job is
to turn two strings and a file path into a verdict: parse a coreutils DURATION to
seconds, reject zero (coreutils treats timeout 0 as no limit), reject non-positive and
malformed values, read the job's real timeout-minutes out of the checked-out workflow
file, and compare the two with headroom.

It is the most branch-heavy thing in the workflow and it has no test. Reviewing it meant
reconstructing a 20-case accept/reject table by hand, twice, in two different review
rounds.

Why it belongs in scripts/

This repo already has roughly 50 scripts/check-*.mjs paired with check-*.test.mjs,
and scripts/check-test-wiring.mjs enforces the pairing and the invocation. A
scripts/check-census-timeout.mjs would:

• turn that hand-reconstructed table into a checked-in assertion,
• run on every PR through the node-tests lane instead of every Monday,
• be mutation-testable, which eight lines of inline YAML can never be.

The inputs it must keep rejecting, all measured on the current shell version:

accept   50m -> 3000s, 10s -> 10s, 3000 -> 3000s, and exactly the budget
reject   0, 0s, 0m, 0.5s, 0.9        (coreutils no-limit hole, and truncation to 0)
reject   -5m, -1                      (negative)
reject   1h, 90m, 1.5h, 1d, 3301      (over budget)
reject   " 50m", "50 m", "", 50M, 50min, +50m, 1e3
reject   99999999999999999999d        (clamps to LLONG_MAX, fails closed)

Plus the cross-check: it must fail when the file's timeout-minutes disagrees with the
declared copy, when the file cannot be read, and when more than one timeout-minutes:
line matches.

What should stay in YAML

Per the review that raised this: the timeout wrapper and its exit-code message have to
wrap the invocation; the rows assertion is eight lines and a glob; and both gh blocks
are genuinely workflow-shaped and match deploy-nightly.yml and review-lane-canary.yml
line for line, so extracting them would create a third dialect for two existing copies.

Related, separate

Those two gh blocks are now the THIRD near-identical copy of file-an-ops-issue logic in
this repo (deploy-nightly.yml, review-lane-canary.yml, and this lane). That is a
scripts/lib/ candidate in its own right, and it is the piece #4144's sweep would
otherwise install a fourth and fifth copy of.

Raised by code review on the #4127 workflow PR, deferred there because it is a
restructure rather than a fix and that PR had already been through three rework rounds.

[BIMvoice]

Read both workflows in full on `upstream/main`: `.github/workflows/geometry-census-heavy.yml` (212 lines) and the `geometry-census` job in `.github/workflows/test.yml` (lines 1595-1637). Neither contains a DURATION-parsing/coreutils-timeout validation block — no `timeout -k`, no duration-to-seconds parsing, no cross-check against `timeout-minutes`. Grepped the whole tree for `DURATION`, `coreutils`, `LLONG_MAX`; no hits related to this. Also checked the two open PRs touching this area (#4158, which only changes the Rust test harness, and #4145) — neither adds it.

The coreutils `timeout`-wrap idea traces to your ranked-item #2 comment on #4127, but it hasn't been implemented in any workflow file or PR yet, so there's no inline shell block to extract. Rewriting this against whatever lands for #4127 item 2 (or once that shell exists) would unblock it.

[louistrue]

Note for anyone reading this before the workflow PR lands: the ~60 lines of interval-validation shell this issue proposes extracting do NOT exist on main. They are added by branch fix/4127-census-fail-loud (the workflow half of #4127), which is being pushed now. Reading .github/workflows/geometry-census-heavy.yml on main and finding no timeout block is correct and expected. This issue is blocked on that branch and only becomes actionable once it merges. Apologies to anyone who lost an investigation to that; filing against unpushed work was my error.