fix: GH Actions workflows - enforce lint/typecheck, add timeout, fix triggers

- lint.yml: remove || echo so lint errors actually fail the workflow
- typecheck.yml: remove || echo, switch to Bun, add apps/elysia typecheck
- update-submodule.yml: upgrade checkout@v6, add payload validation + push retry
- security.yml: add Rust to CodeQL scan targets
- docker-build-push.yml: remove stale packages/ path refs
- All workflows: add timeout-minutes to prevent stuck jobs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/lint.yml

@@ -18,6 +18,7 @@ on:
 jobs:
   eslint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
         with:
@@ -26,4 +27,4 @@ jobs:
         with:
           node-version: 22
       - run: npm install -g eslint @antfu/eslint-config
-      - run: eslint . --no-error-on-unmatched-pattern || echo "Lint check completed (best-effort)"
+      - run: eslint . --no-error-on-unmatched-pattern