fix(ci): Grant contents:read permission to CI callers and add timeouts

- ci-prod.yml and ci-dev.yml need contents:read to call reusable-ci.yml
- Add timeout-minutes: 30 to generic-tests, e2e-core, e2e-optional jobs
- Limit gotestsum retries to 2 in reusable-ci.yml

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: bvt123

.github/workflows/ci-dev.yml

@@ -18,7 +18,8 @@ on:
           - "false"
           - "true"
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   ci:

.github/workflows/ci-prod.yml

@@ -18,7 +18,8 @@ on:
           - "false"
           - "true"
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   ci:

.github/workflows/reusable-ci.yml

@@ -71,6 +71,7 @@ jobs:
     needs: build
     name: tests / ${{ inputs.stream }} / ${{ matrix.suite.name }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -137,7 +138,7 @@ jobs:
             --junitfile="reports/${{ inputs.stream }}-${{ matrix.suite.name }}.xml" \
             --junitfile-project-name="${{ matrix.suite.group }}" \
             --junitfile-testsuite-name="short" \
-            --rerun-fails \
+            --rerun-fails=2 \
             --format github-actions \
             --packages="./${{ matrix.suite.group }}/${{ matrix.suite.path }}/..." \
             -- -timeout=15m $EXTRA_GO_TEST_ARGS
@@ -156,6 +157,7 @@ jobs:
     needs: [build]
     name: e2e-core / ${{ inputs.stream }} / ${{ matrix.suite.name }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -204,6 +206,7 @@ jobs:
     needs: [build]
     name: e2e-optional / ${{ inputs.stream }} / ${{ matrix.suite.name }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix: