fix(sre): close bounded runtime contract gaps

.gitea/workflows/cd.yaml

@@ -4931,7 +4931,11 @@ jobs:
     # post-deploy smokes would only retest the previous production artifact.
     if: ${{ github.event_name != 'push' || (!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, 'cancel-stale-cd') && !contains(github.event.head_commit.message, '[metadata-only]')) }}
     needs: [build-and-deploy]
-    timeout-minutes: 30
+    # 2026-07-16 Codex: the fail-hard pressure gate below may legitimately
+    # consume 20 minutes while a bounded backup and its metric freshness
+    # window drain. Preserve enough time for the independent post-deploy
+    # verifier instead of replacing one false failure with a job timeout.
+    timeout-minutes: 45
     # 2026-04-30 Codex: keep post-deploy on the host runner too. Playwright
     # install-deps can also kill the act-managed job container with RWLayer=nil.
     runs-on: awoooi-non110-host
@@ -4958,6 +4962,13 @@ jobs:
       - name: Wait for Host Web Build Pressure
         # 2026-06-28 Codex: post-deploy is browser-heavy; fail closed on host
         # pressure until runner load is isolated from production.
+        # 2026-07-16 Codex: the bounded production pg_dump can legitimately run
+        # for up to 15 minutes and Docker CPU metrics can remain fresh for five
+        # more minutes.  Keep the gate fail-hard, but align this post-deploy
+        # wait with that 20-minute evidence window so a healthy backup does not
+        # turn an already-successful rollout into a false CD terminal failure.
+        env:
+          HOST_WEB_BUILD_PRESSURE_ATTEMPTS: "120"
         run: bash scripts/ci/wait-host-web-build-pressure.sh
 
       - name: Get Commit Info