ci: bound Context7 refresh transport

[kriptoburak]

Summary

• restrict the Context7 refresh request to HTTPS with TLS 1.2 or newer
• add a 10-second connection timeout and 30-second total timeout
• pin the runner to Ubuntu 24.04 and cap the job at 5 minutes

Validation

• actionlint .github/workflows/context7-refresh.yml
• git diff --check
• verified the fixed runner, job timeout, and bounded curl controls
• simplify, maintainability, and security reviews completed with no findings

OpenSSF relevance

This bounds a secret-bearing external CI request and makes failure behavior deterministic.

Note

Bound Context7 refresh job with timeouts and TLS constraints

• Pins the job runner to ubuntu-24.04 and adds a 5-minute timeout-minutes cap to the context7-refresh workflow
• Adds --connect-timeout 10, --max-time 30, --proto '=https', and --tlsv1.2 to the curl call so slow or hanging requests to the Context7 refresh API fail fast and are restricted to HTTPS/TLSv1.2

^{Macroscope summarized 3913ee4.}

[furkanerday]

Reviewed the complete diff, PR description, all conversation and review history, unresolved threads, repository policies, relevant contracts and tests, required checks, and commit sign-offs at 74f0680. All required checks pass, no actionable thread remains, and I found no blocking issue.