fix(ci): remove canvas-deploy-reminder from all-required.needs

The all-required aggregator was hanging on all PRs because it waited
for canvas-deploy-reminder, which has `if: github.ref ==
'refs/heads/staging'` — always false for PR events. Gitea evaluates
the needs dependency before the if condition, so all-required got stuck
waiting for a job that skips.

The comment at all-required already said canvas-deploy-reminder was
"intentionally excluded" but the needs: list still included it. This
commit removes it from needs: to match the documented intent, and adds
a timeout-minutes: 2 defensive cap on canvas-deploy-reminder itself.

Fixes the deadlock blocking PR #1122 (channels.go marshal-error
checks). Also observed blocking other open PRs on staging.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -403,11 +403,17 @@ jobs:
   canvas-deploy-reminder:
     name: Canvas Deploy Reminder
     runs-on: ubuntu-latest
+    timeout-minutes: 2
     # mc#774 root-fix: added job-level `if:` so ci-required-drift.py's
     # ci_job_names() detects this as github.ref-gated and skips it from F1.
     # The step-level exit 0 handles the "not main push" case; the job-level
     # `if:` makes the gating explicit so the drift script sees it.
     # continue-on-error removed (was mc#774 mask): step exits 0 when not applicable.
+    #
+    # NOTE: This job is NOT in all-required.needs (fix/channels-marshal-errors PR #1122).
+    # It has `if: github.ref == refs/heads/staging' which is false for all PR events.
+    # Including it in all-required.needs caused all-required to hang indefinitely on PRs
+    # because Gitea waits for a job that skips after the wait begins.
     if: ${{ github.ref == 'refs/heads/staging' }}
     needs: [changes, canvas-build]
     steps:
@@ -573,10 +579,11 @@ jobs:
     #     audit-force-merge.yml's REQUIRED_CHECKS env (RFC §4 + §6).
     #
     # canvas-deploy-reminder is intentionally excluded from all-required.needs:
-    # it needs canvas-build, which is skipped on CI-only PRs (canvas=false).
-    # Including it in all-required.needs causes all-required to hang on
-    # every CI-only PR. Keep it runnable on PRs via its own
-    # `needs: [changes, canvas-build]` — the sentinel only aggregates the result.
+    # it has `if: github.ref == 'refs/heads/staging'` which is always false for PRs.
+    # Including it in all-required.needs caused all-required to hang indefinitely on
+    # PRs because Gitea waits for the job result before evaluating the `if` condition.
+    # Keep it runnable on PRs via its own `needs: [changes, canvas-build]` —
+    # the sentinel only aggregates the result.
     #
     # Phase 3 (RFC #219 §1) safety: underlying build jobs carry
     # continue-on-error: true so their failures are masked to null (2026-05-12: re-enabled mc#774 interim)
@@ -596,7 +603,6 @@ jobs:
       - canvas-build
       - shellcheck
       - python-lint
-      - canvas-deploy-reminder
     if: ${{ always() }}
     steps:
       - name: Assert every required dependency succeeded