The 'timeout 900 npm ci' wrapper introduced in round-3 has caused two
real release-pipeline failures, both for npm signal-handling reasons:

1. First retry hung 40+ min on cold-cache install — the timeout did
   fire (busybox SIGTERM) but npm's child install (node-linux-x64
   postinstall) survived in a separate process group. Manual kill -9
   needed.
2. Second retry failed within ~2 min with 'npm error Exit handler
   never called!' — npm 11 self-bug triggered by the timeout wrapper
   interacting with npm's internal exit handlers (npm/cli#8269+).

Round-4 review predicted that the timeout was 'judgment call, skip' —
real-world experience confirmed it. The timeout protects against an
indefinite GitHub-down hang that has never happened in practice.
Manual intervention on a hang is acceptable; a broken release
pipeline that publishes nothing is not.

Removing the wrapper from both build-js-fresh and the CI install
step. NPM_CI_TIMEOUT variable also removed (no longer referenced).