fix: GH Actions workflows - enforce lint/typecheck, add timeout, fix triggers

- lint.yml: remove || echo so lint errors actually fail the workflow
- typecheck.yml: remove || echo, switch to Bun, add apps/elysia typecheck
- update-submodule.yml: upgrade checkout@v6, add payload validation + push retry
- security.yml: add Rust to CodeQL scan targets
- docker-build-push.yml: remove stale packages/ path refs
- All workflows: add timeout-minutes to prevent stuck jobs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/security.yml

@@ -9,11 +9,12 @@ on:
 jobs:
   codeql:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       security-events: write
     steps:
       - uses: actions/checkout@v6
       - uses: github/codeql-action/init@v3
         with:
-          languages: javascript-typescript
+          languages: javascript-typescript, rust
       - uses: github/codeql-action/analyze@v3