Add timeout, busy-state, parser-variant and build-freshness rules

- task-discipline: require explicit target platform/language before implementation
- go-api: bounded context deadline on every outbound network/DB call
- controls-selection: visible busy state for any control triggering such a call
- import-export: enumerate real format variants before writing a parser
- app-binary: embedded assets do not hot-reload; verify rebuild before diagnosing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rules/patterns/go-api/contract.md

@@ -1,6 +1,6 @@
 # Contract: REST API Conventions (Go Web Applications)
 
-Version: 1.1
+Version: 1.2
 
 ## URL Naming
 
@@ -68,6 +68,16 @@ All non-2xx responses return a consistent JSON body:
 - File uploads use `multipart/form-data`.
 - Query parameters for filtering and pagination: `?page=1&per_page=50&search=abc&status=active`.
 
+## Timeouts
+
+- Every outbound network or database call must run under a bounded `context.Context` deadline.
+  No call reachable from a user action may block indefinitely.
+- The deadline is set by the handler or service that owns the request, not by the caller of the app.
+- On timeout, return a real error status (`504` for an upstream timeout, `500` for an internal one)
+  with a human-readable message. Never let a timed-out call fall through as an empty success.
+- The UI side of the same rule — visible busy state for the duration of the call — is owned by
+  `controls-selection`.
+
 ## Health and Utility Endpoints
 
 Every application must expose: