Allow complete release candidate validation

.github/workflows/build-release-candidate.yml

@@ -22,7 +22,7 @@ jobs:
   build:
     name: Build and Validate Signed Candidate
     runs-on: ubuntu-24.04
-    timeout-minutes: 35
+    timeout-minutes: 60
     outputs:
       artifact_name: ${{ steps.identity.outputs.artifact_name }}
       manifest_artifact_name: ${{ steps.identity.outputs.manifest_artifact_name }}

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -330,6 +330,10 @@ TLS floor in the dynamic config.
    of downloading the complete release packet again. Historical repair and
    release-edit validation may use the full-download fallback because those
    paths do not have a same-run candidate manifest.
+   The candidate job timeout must cover signed multi-platform assembly, full
+   local packet validation, manifest creation, and artifact upload; the
+   observed release path requires a 60-minute ceiling even though the build
+   itself is expected to finish much earlier.
    A manually dispatched release rehearsal must activate the same signed
    candidate build whenever its required `version` input is non-empty.
    Scheduled watchdog rehearsals omit that input and must skip candidate

scripts/release_control/release_promotion_policy_test.py

@@ -618,6 +618,7 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("PULSE_UPDATE_SIGNING_PUBLIC_KEY: ${{ vars.PULSE_UPDATE_SIGNING_PUBLIC_KEY }}", content)
         self.assertIn("PULSE_UPDATE_SIGNING_PUBLIC_KEY=${{ vars.PULSE_UPDATE_SIGNING_PUBLIC_KEY }}", content)
         self.assertIn("Validate installer signing key pins", candidate_workflow)
+        self.assertIn("timeout-minutes: 60", candidate_workflow)
         self.assertIn("go run ./scripts/release_update_key.go public-key-ssh", candidate_workflow)
         self.assertIn("does not trust the configured release signing key", candidate_workflow)
         self.assertIn("TRUSTED_SSH_PUBLIC_KEY", update_demo_workflow)