ci: adopt native test budget with preserved policy mutations - #1069

The native test package approached the existing 600-second alarm. Adopt the already approved 15-minute budget using the suffix ordering recognized by the installed validator: go test -v -race -coverprofile=coverage.out ./... -timeout=15m.

This preserves the unchanged harness's two command mutations, which were no-ops with the original prefix ordering. The five-file change is exactly ci.yml plus E/C/A/P: relabel the existing staged CI context in E4/C63/A11/P1 rows and change one native command statement digest. Active rows, full38 authority, checker, adoption guard, wrapper, harness, secrets, other workflows and operation/test assertions stay unchanged. ADR0192/SF2 records this boundary; floor restoration and promotions remain separate PRs.

Validation before publication:

• Actual installed trusted-base wrapper/core/full scanner: PASS for all 11 workflows against exact tree 0e4364b77255e373efcee8652516069827da4b31, with no candidate fallback.
• Six focused producer controls match their expected outcomes; both suffix mutations alter the command and retain 15m. Unchanged harness Bash syntax passes. These controls do not substitute for full harness or native acceptance.
• Independent Source2 security/antagonistic reviews cover the full five-file diff. Ordinary current-head hosted policy, native, security, quality and protected checks remain required before acceptance.

Original head 4efb90ba7c735c64fea1c70aab3a14735fe683fc and failed policy run https://github.com/GoCodeAlone/workflow/actions/runs/38691777606 remain in history. Local Go stopped after a separate floor-guard setup encountered a denied shared-cache object; no cache override or retry was used. Floor PR1066 remains untouched and unaccepted.

Main5850's full OSV run remains genuinely failed with unchanged findings and incomplete toolchain analysis. This PR requires its ordinary fresh security result; the expired PR1070 admission supplies no authority here. No stable release, deployment or runtime/security acceptance is claimed.