chore(nix): time-bound local builds (timeout = 60) — backstop for max-jobs = 1

Follow-up to 9430c9b. `max-jobs = 1` reopened the door for ANY uncached
derivation to build locally, including derivations whose outputs SHOULD
be substituted but happen to miss the cache (network blip, hash drift,
operator forgot to push). On ATM hardware a kernel/electron/rustc build
would take literal hours and silently wedge the kiosk while it churns.

`timeout = 60` caps every local build's wall-clock at 60s. Activation-
time stitches (boot.json, system-units, X-Restart-Triggers, etc.) finish
in well under a second; anything that doesn't return by 60s is by
definition a heavy compile that has no business running on an ATM.
Killing it fast makes the upgrade fail loudly so the operator can fix
the cache miss, rather than the box silently chewing CPU all night.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

flake.nix

@@ -152,6 +152,14 @@
               # (systemd-boot's boot.json).
               nix.settings = {
                 max-jobs = 1;
+                # Hard ceiling on any local build's wall-clock time. Activation-
+                # time stitch derivations (boot.json, system-units, etc.) finish
+                # in well under a second; anything that doesn't return in 60s
+                # is by definition a heavy compile that has no business running
+                # on ATM hardware (kernel, electron, rustc). Kill it fast so
+                # the upgrade fails loudly instead of silently wedging the box
+                # for an hour. Time-bounds the max-jobs=1 escape hatch.
+                timeout = 60;
                 trusted-users = [ "root" "lamassu" ];
                 substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ];
                 trusted-public-keys = [