agents: hard timeout on agent runs — a hung model must not block the runner

A stalled local-ollama generate on a trivial @intern question held the single
runner slot for ~1h, queueing every agent run instance-wide (homelab run 869).

- run-agent.sh: each opencode attempt wrapped in `timeout -k 30 $AGENT_TIMEOUT`
  (default 1200s). rc=124 is not retried — a hung backend stays hung; fail fast
  and free the runner.
- agent.yml: job-level timeout-minutes: 45 as backstop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/agent.yml

@@ -36,6 +36,9 @@ jobs:
         contains(github.event.comment.body, '@ops') ||
         contains(github.event.comment.body, '@intern')))
     runs-on: ci-runner
+    # Job-level backstop (the per-attempt `timeout` in run-agent.sh is the primary guard): a wedged
+    # job must never hold the single runner slot for hours.
+    timeout-minutes: 45
     steps:
       - name: Acknowledge with 👀
         env: