ci(#2280): fix release-pipeline workflow defects (finalize timeout + auto-backmerge build:lib) (#2281)

Closes #2280

- release.yml: finalize timeout 10 -> 30 (match rc)
- auto-backmerge.yml: npm ci + build:lib before version-sync so the version hook can require the gitignored capability-ledger.cjs

.github/workflows/auto-backmerge.yml

@@ -141,6 +141,16 @@ jobs:
             echo "dropped_oneline=" >> "$GITHUB_OUTPUT"
           fi
 
+      # The version bump below fires the `version` npm lifecycle hook, which runs
+      # gen-capability-registry.cjs. That validator lazily require()s the built
+      # gsd-core/bin/lib/capability-ledger.cjs (a build:lib output, gitignored);
+      # when it is absent the bounded fragment reader falls back to a fail-closed
+      # stub and every capability fragment reports "could not be read", failing
+      # the sync. Build the ledger first so fragments materialize.
+      - name: Install dependencies and build (required by the version-sync hook)
+        if: steps.check.outputs.next_exists == 'true'
+        run: npm ci --silent && npm run build:lib
+
       - name: Sync next's version to main's released version
         if: steps.check.outputs.next_exists == 'true'
         run: |

.github/workflows/release.yml

@@ -507,7 +507,10 @@ jobs:
     needs: [validate-version, install-smoke-finalize]
     if: inputs.action == 'finalize'
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # Matches the rc job's budget: `npm ci` + `npm run test:coverage:unit` now
+    # exceeds 10m as the unit suite grows, so a 10m cap cancels the job mid-test
+    # before tag/publish. 30m gives the same headroom rc already relies on.
+    timeout-minutes: 30
     permissions:
       contents: write
       pull-requests: write