ci(repo): fix ai-review gh repo inference and scripts-ci timeout

.github/workflows/ai-review.yml

@@ -156,8 +156,12 @@ jobs:
           PR: ${{ needs.resolve.outputs.pr_number }}
         run: |
           mkdir -p /tmp/ai-review
-          gh pr diff "$PR" > /tmp/ai-review/pr.diff
-          gh pr view "$PR" --json number,title,body,baseRefName,headRefName,additions,deletions,changedFiles \
+          # `gh` infers the repo from the current directory's git remote, but this
+          # job checks out into `pr/` and `trusted/` subdirs, so $GITHUB_WORKSPACE
+          # itself is not a git repo — pass --repo explicitly.
+          gh pr diff "$PR" --repo "$GITHUB_REPOSITORY" > /tmp/ai-review/pr.diff
+          gh pr view "$PR" --repo "$GITHUB_REPOSITORY" \
+            --json number,title,body,baseRefName,headRefName,additions,deletions,changedFiles \
             > /tmp/ai-review/pr.json
 
       # Pin the exact published version so a new Claude Code release can't
@@ -303,7 +307,8 @@ jobs:
           PR: ${{ needs.resolve.outputs.pr_number }}
         run: |
           mkdir -p /tmp/ai-review
-          gh pr diff "$PR" > /tmp/ai-review/pr.diff
+          # Pass --repo explicitly so `gh` never depends on cwd being a git repo.
+          gh pr diff "$PR" --repo "$GITHUB_REPOSITORY" > /tmp/ai-review/pr.diff
 
       - name: Prepare merged-review output schema
         run: |

.github/workflows/github-scripts-ci.yml

@@ -21,7 +21,11 @@ jobs:
   test:
     name: Test and type-check
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # The shared setup installs the full workspace + Go toolchain via mise, which
+    # runs ~9-10 min; a 10-minute cap raced the install and got cancelled on a
+    # cold cache. 20 gives that install headroom. (This check is heavier than it
+    # needs to be for two scripts — slimming the setup is a possible follow-up.)
+    timeout-minutes: 20
     permissions:
       contents: read
     steps: