ci: the macOS check and the merge-queue cap go to 45 minutes, with a warning at 35

[REPPL]

The macOS check now has 45 minutes instead of 30, and it warns at 35. Four
pull requests whose code was fine (#728, #730 twice, #733) were thrown out of
the merge queue because the macOS check ran a little past 30 minutes. The
technical facilitator ruled on 2026-09-28 (ruling Z) that both limits rise to
45 minutes. The same ruling's cancel policy adds an early warning, so a
check that is getting slow is flagged before it is ever cancelled.

What changes:

• .github/workflows/ci.yml: the check job's timeout-minutes is one
  matrix expression. The macOS leg gets 45 and the ubuntu leg keeps 30. The
  comment above the job explains the ceiling and names the ruling.
• A new last step on the macOS leg warns, in the log and in the step summary,
  when a check that ran past 35 minutes ends. It is emitted at the job's end,
  not at minute 35, so a check that passes between 35 and 45 minutes says so
  before one is ever cancelled at the cap. The warning names the rerun-once
  rule and says to open a speed lane. It runs under always(), carries
  continue-on-error, and cannot fail the job. It reads the job's start time
  from a new first step's output through env, never through an expression
  inside run:.
• .abcd/work/rulesets/main-protection.json: the mirror's merge-queue
  check_response_timeout_minutes goes from 30 to 45. Nothing else in the
  file changes.
• TestRaceLaneBudgetIsDeclaredAndFitsItsJob reads the ceiling leg by leg and
  holds each leg at or below the mirror's cap, and every leg but macOS at 30
  (the ruling raised the macOS leg alone). The new
  TestCheckJobWarnsBeforeTheQueueCap pins the threshold at 35, below both
  the macOS ceiling and the cap, and checks the step's shape.
• .abcd/work/DECISIONS.md gains one entry recording rulings Z and AR and the
  cancel policy.

After this merges, the run's orchestrator changes the live ruleset's merge-queue
check_response_timeout_minutes to 45 with gh api, under ruling Z, and logs
that as a decision. Until then the live queue still fails a group at 30
minutes. No gate compares the mirror with the live ruleset (that drift check is
itd-92, still a draft), so nothing turns red in that window. A macOS run
between 30 and 45 minutes in a merge group is still cancelled by the queue
until the live change is made.

Checks: make preflight passed and minted a receipt. make fmt-check is
clean, zizmor reports no findings on ci.yml, and abcd lint docs
reports 0 blockers.

Resolves: iss-2609281514435020
Assisted-by: Claude:claude-opus-5-5