policy: add roam-scan timeout