fix: three generator-validity hazards (timeout on reusable callbacks, env-less rollback needs, unsafe job-ID names)

[joshua-temple]

Fixes three generator-validity hazards confirmed against actionlint 1.7.12. Each is a separate commit with its own failing-test-first change.

F2 - timeout-minutes on reusable-workflow callbacks (GitHub rejects at parse)

GitHub forbids timeout-minutes on a job that calls a reusable workflow (allowed caller keys: name, uses, with, secrets, needs, if, permissions, strategy, concurrency). The generator emitted job-level timeout-minutes whenever timeout_minutes > 0, including on uses: callbacks.

actionlint before: when a reusable workflow is called with "uses", "timeout-minutes" is not available ...

Fix: gate the explicit-timeout emission on the callback being inline run:, mirroring the existing environment: gate. For uses: callbacks the timeout must live inside the called workflow.

F3 - rollback/finalize needs nonexistent deploy jobs when environments is empty (GitHub rejects at parse)

Deploy jobs in promote.yaml are only written when there is at least one environment, but rollback jobs and the finalize job referenced deploy jobs unconditionally when deploys: was non-empty. With environments: [] plus a configured deploys:, the emitted needs: lists (and DEPLOY_RESULT_* env vars) pointed at jobs that never existed.

actionlint before: job "rollback-..." needs job "deploy-..." which does not exist in this workflow and the same for finalize.

Fix: skip rollback generation and the deploy-job references in finalize when there are no environments.

F4/F5 - callback/env names with invalid job-ID characters (GitHub rejects at parse)

Names with characters outside the GitHub job-ID grammar (such as ., spaces, or /) produced invalid job IDs (build-app.web, build-my app) and broke the ${{ }} dereferences that read their outputs.

actionlint before: invalid job ID "build-app.web" ... and receiver of object dereference ... must be type of object but got "string".

Fix: reject such names at config validation with a clear message (builds[i].name "<name>" must contain only letters, digits, hyphens, and underscores) for build, deploy, external-deploy, and environment names. Names are rejected rather than sanitized so two distinct names cannot collapse to one job ID. Hyphens, uppercase, leading digits, and underscores remain valid since the name is a suffix after the build-/deploy- prefix.

Verification

• go build ./..., go test ./... (1211 passing), golangci-lint run on internal/generate and internal/config: all green.
• For F2 and F3, generated sample workflows and confirmed with actionlint that the specific parse errors are gone.
• Each fix has a test that fails before the change. Golden tests and e2e scenarios that asserted the buggy output (callback-timeout) were updated to use inline run: so they still verify the underlying feature.