Keep infrastructure details out of the repository

The README, the publish script and the workflow named the tarball host, its
address and filesystem paths on the web host and the runner. Hosts and paths
now come only from repository variables, and the workflow shares the work
tree and the build cache through the named Docker volumes jasp-build and
jasp-cache instead of host paths. (The runner does not expand ${{ vars }} in
container.volumes, so a variable could not have replaced the host path there.)

Also drop the unused scripts/gen-tarball-index.py, and give each module build
its own process under a time limit: a module once spun for eight hours in
jaspModuleTools' bundling step and stalled the whole build.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

build/build-jasp.sh

@@ -422,7 +422,16 @@ for attempt in 1 2 3; do
   done
   [[ ${#MODULE_PATHS[@]} -eq 0 ]] && break
   log "module build pass ${attempt}/3: ${#MODULE_PATHS[@]} modules left"
-  Rscript /work/build/build-modules.R "${MODULE_PATHS[@]}" || true
+  # One R process per module under a time limit. A module once spun at 100%
+  # CPU for 8 hours inside jaspModuleTools' bundling step, after it had
+  # installed fine, and stalled the whole build; the same module bundled in two
+  # minutes on the previous run. A timed-out module is simply retried in the
+  # next pass.
+  for path in "${MODULE_PATHS[@]}"; do
+    timeout --kill-after=60 "${MODULE_TIMEOUT:-5400}" \
+      Rscript /work/build/build-modules.R "$path" \
+      || log "$(basename "$path") did not finish (exit $?), retrying next pass"
+  done
   built=0
   for module in "${ALL_MODULES[@]}"; do
     [[ -f "${MODULE_BUNDLES}/${module}.JASPModule" ]] && built=$((built + 1))