ci(benchmark): size the hang guard for the slowest runner

The first PR run landed on srvhome, about 1.9 times slower than
nessar-desktop. The fixed 300-second timeout killed its protocol during the
loaded year, although every completed scenario was within its relative
budget. Raise the CI timeout to 600 seconds and the test timeout to 570
seconds so they only guard against hangs, and record the first CI-runner
ratios.

Refs #285

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/gitea-actions.md

@@ -21,7 +21,7 @@ configuration; the Compose files remain manual deployment options.
 | `policy`    | Tests the policy and publisher, then validates the checked-out commit, GitFlow, PR title, commits, and stable release version.                                                                                                                                                                                                               |
 | `validate`  | Runs lint, formatting, and application/test type checks.                                                                                                                                                                                                                                                                                     |
 | `test`      | Runs functional coverage with one worker and a 2 GiB Node heap; uploads coverage for seven days even on failure.                                                                                                                                                                                                                             |
-| `benchmark` | Required seven-scenario protocol (one warm-up, two measured repetitions) outside coverage with one worker and a 2 GiB Node heap. It first times the frozen engine on `two years` (best of three) and fails any scenario whose mean planning time exceeds its multiplier times that calibration; the 300-second timeout is only a hang guard. |
+| `benchmark` | Required seven-scenario protocol (one warm-up, two measured repetitions) outside coverage with one worker and a 2 GiB Node heap. It first times the frozen engine on `two years` (best of three) and fails any scenario whose mean planning time exceeds its multiplier times that calibration; the 600-second timeout is only a hang guard. |
 | `build`     | Builds browser/server production bundles and retains `dist` for seven days.                                                                                                                                                                                                                                                                  |
 | `security`  | Runs Semgrep JavaScript/TypeScript SAST and Trivy dependency/secret scans; retains SARIF reports for seven days. Scanner execution must succeed; findings remain reports rather than a new severity gate.                                                                                                                                    |
 | `images`    | Publishes branch/SHA images after required validation, including the benchmark, or promotes an existing SHA image for a stable tag. Runs only for pushes and same-repository PRs.                                                                                                                                                            |
@@ -32,7 +32,7 @@ publication (`images.needs` includes `benchmark`) and the `required` aggregate.
 The relative gate absorbs a slower runner and load that lasts through the whole
 job, because calibration runs in the same job. It does not absorb load that
 starts or stops during the protocol, such as an overlapping push and
-pull_request run of the same commit; the 300-second hang guard still bounds
+pull_request run of the same commit; the 600-second hang guard still bounds
 those runs.
 
 Push and PR runs are separate so PR title and rebase checks run on the PR event.