fix(ci): filter blobs in the standalone workflows and bound gate-attestation

[forkwright]

Finding

The blob-filter fix landed in hybrid-gate.yml only. The two standalone reusable workflows in
this repo still do unfiltered full-history checkouts, and one of them has no timeout at all.

Evidence

• no-ai-attribution.yml — job no-ai-attribution, timeout-minutes: 5, actions/checkout with
  fetch-depth: 0 and no filter:. This is the exact pattern commit 963532686 fixed inside
  hybrid-gate.yml's check-trailer and ai-attribution jobs; the standalone file was not touched.
• gate-attestation.yml — job gate-attestation, actions/checkout with fetch-depth: 0, no
  filter:, and no timeout-minutes key anywhere, so it inherits GitHub's 360-minute ceiling.
• Both jobs are metadata-only. Verified: every git call in either file is a git log --format=
  (no-ai-attribution.yml:71,74; gate-attestation.yml:50). Neither reads a file's bytes, so
  blob:none — which omits contents while keeping commits and trees — cannot starve them.

Why this matters

An overrunning actions/checkout reports cancelled — the same status GitHub uses for a
superseded run. The two are indistinguishable in the checks list, so a slow clone reads as a normal
supersede while presenting as a policy or gate failure. On aletheia's main this class produced 3
cancelled runs out of 5, one at exactly 5m02s inside actions/checkout, and it read as a broken
build rather than a slow clone.

These are reusable workflows, so the defect is inherited by every adopting repo rather than
confined to one. Fixing hybrid-gate.yml alone left the standalone callers exposed.

The missing timeout is a separate, quieter cost: with no bound, a wedged clone burns six hours of
metered minutes per occurrence against a check that never resolves. CI minutes are the fleet's
binding constraint at high dispatch parallelism, so an unbounded job is a real budget hazard, not a
tidiness point.

Desired correction

Add filter: blob:none to both checkouts, and give gate-attestation an explicit
timeout-minutes: 10 — generous for a metadata-only clone plus one git log, and still fast to
fail when something is genuinely stuck.

Done when: no checkout in this repo fetches blobs for a metadata-only job, and no job here relies
on the default 360-minute ceiling.