P2: A job can budget its whole run

Why

A step is capped, and a job is not. ci.MaxTimeout bounds one step and there is no field that says what the whole job may take, so a job of five slow steps holds a runner for as long as the five allow with no single number saying so. The other half of the same gap is that a step could not ask for more than an hour, which is why an LLM coding session, a soak test, or a slow integration suite could not be expressed in a workflow at all.

This is §3 of #138 (“job-level timeout; today only steps are capped, at one hour each”) and it closes the item that the reference lists as impossible.

Scope

• timeout: 2h on a job: a wall-clock budget its steps share, starting with the first step.
• A step that declares its own timeout: is cut short when the budget ends first; a step that declares none runs with whatever is left, so one long step needs only the job’s number.
• A budget spent before a step starts stops the job there, with one line in the log, instead of running the step on its own cap.
• Pinned with the run, like the steps and the labels: editing the workflow after the push cannot lengthen or shorten a queued job.
• The step ceiling rises from one hour to four, and the default stays ten minutes, so a single long step is expressible without changing what a step that says nothing gets.
• A step whose timeout is longer than the job’s is refused at push time: the budget would end first, so the step could never use what it asked for.
• The same rule in vole workflow run, so a local run spends the budget a runner would.
• Docs: the limits table, the job field table, a timeout section, the step table’s default, and the removal of “job-level timeouts” from what a workflow cannot express.

Not in this change: stopping a job that is already running. That is #162, and it is a queue and runner-protocol change rather than a format one.

Acceptance criteria

• A job with no timeout: behaves exactly as it did before this field existed.
• A job with timeout: 2h and one step that declares nothing runs for up to two hours, and a job whose budget ends fails at the next step with a log line naming the budget.
• The image build is not charged to the budget; it keeps its own cap.
• vole workflow run fails the same way, with the same message, when the budget runs out.
• Any value above four hours, or a step timeout longer than the job’s, fails the push that introduced it, naming the field.

Related

• #138 tracks the rest of the format gaps.
• #162 is the other half: stopping a run that is already going.