ci: move jobs off dead Depot runners to GitHub-hosted

[0xNilesh]

Unblocks CI on develop. Infra-only — no application code touched.

Problem

Seven jobs never run on this branch. They aren't failing — they sit queued forever until
GitHub cancels them at the 24-hour mark, which is why they surface as fail with a duration of
24h0m0s:

job	runs-on	state
test-unit-cover	depot-ubuntu-24.04-16	queued → cancelled
test-fuzz	depot-ubuntu-24.04-4	queued → cancelled
Run golangci-lint	depot-ubuntu-24.04-8	queued → cancelled
jsonrpc-compatibility-test	depot-ubuntu-22.04-8	queued → cancelled
Analyze (go / javascript / python)	depot-ubuntu-24.04-8	queued → cancelled

depot-* is a custom label served only by Depot runners. GitHub has
nothing to dispatch these jobs to unless Depot is connected — behaviourally identical to a
self-hosted label with no runner online. Depot did work here historically (system-test succeeded
2026-06-16 and 2026-06-27), but every run since ~2026-07-27 is stuck, so access lapsed
account-side. The labels are inherited from upstream cosmos/evm, not something this fork chose.

Consequence: the Go unit suite, lint, fuzz, CodeQL and JSON-RPC compat have never validated this
branch. Concretely, PR #37 adds two new test files that have never executed in CI.

Change

Point those jobs at GitHub-hosted runners, which are free and unmetered for public repositories:

- runs-on: depot-ubuntu-24.04-16   # test-unit-cover
- runs-on: depot-ubuntu-24.04-4    # test-fuzz
- runs-on: depot-ubuntu-24.04-8    # golangci-lint, CodeQL
- runs-on: depot-ubuntu-22.04-8    # jsonrpc-compatibility-test
+ runs-on: ubuntu-latest

GitHub's free runners are 4-core where Depot's were 4–16, so timeouts sized for the bigger
boxes need headroom — otherwise this trades queued forever for timeout:

• Makefile: test/lint timeouts 15m → 30m (COMMON_COVER_ARGS, test-unit, test-evmd,
  test-unit-cover, test-all, and golangci's own --timeout)
• lint.yml: golangci timeout-minutes: 15 → 30

jsonrpc-compatibility-test keeps its existing cap; test-unit-cover / test-fuzz have no job
cap and inherit GitHub's 360 min default.

Relationship to #36

This is the same fix #36 applied to the v0.7 line (now develop-0.7). It was never on the v0.6
line, which is now develop. This branch additionally covers codeql-analysis.yml, which #36 did
not touch.

Alternative worth trying first

Depot offers a free tier for open-source projects and this repo qualifies. If someone
reconnects Depot under that plan, everything goes green with zero changes and the fork's
workflows stay byte-identical to upstream — which keeps future upstream merges clean. This PR is
the fallback if that isn't viable; it's a small revert either way.

Validation

The real proof is this PR's own checks: the five jobs above should go from 24h0m0s / fail to
actually executing. Please confirm they run green before merging — if test-unit-cover now fails
for a genuine reason, that's a pre-existing breakage this change has surfaced, not caused.