auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

- hub_jwt: aud list is ["windy_git"] (contract v1 array). Dropped
  "windy-git": that is Gitea's OIDC client_id, so a forge id_token would
  have passed the aud check. `type: human` is now REQUIRED (id_tokens have
  none), which makes accepting the discovery-URL issuer safe.
- runner job ceiling 30m -> 90m: eternitas's serial pytest is ~50 min and
  would have been killed mid-suite.
- eternitas (private) added to the GitHub status bridge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/runner/config.yaml

@@ -12,7 +12,8 @@ log:
 runner:
   file: /data/.runner
   capacity: 1          # per runner; parallelism = number of runner services (6). See docker-compose.yml
-  timeout: 30m
+  timeout: 90m          # hard ceiling per job. eternitas's serial pytest is ~50 min; keep
+                        # timeout-minutes in each workflow — a hang still reads as a hang
   shutdown_timeout: 3m
   insecure: false
   fetch_timeout: 5s